It would certainly make a big fuss. First the identity of that person would be stigmatized to a point where it wouldn't be usable anymore to gain trust to othe

It would certainly make a big fuss. First the identity of that person would be stigmatized to a point where it wouldn't be usable anymore to gain trust to other projects. Publishing rights certainly would get revoked for that user. Then all packages published by him/her will need to be analyzed for further exploits and discussions would happen to avoid future similar issue. If possible a patch/fix would get published by the distribution.