"he emailed me and said he wanted to maintain the module, so I gave it to him. I don't get any thing from maintaining this module, and I don't even use it anymore, and havn't for years"

This is the risk of open source not figuring out funding.

Listening to https://podcast.sustainoss.org/157 yesterday a great point was made about two distinct roles - the "author" (original person creating the library) and the "maintainer" (person continuing updates, feature requests, etc) and sounds like in this case this is an author who was nudged into being a maintainer, and them being funded may still not have been beneficial

Not really. Even if it was somehow funded, the original author may still want to stop maintaining it and hand it over to someone else.

So it's an entirely different issue.

I don't understand why he didn't tell them to fork. The risk of him making new changes was so low.

> This is the risk of open source not figuring out funding.

Not necessarily. There is software I built for me, thought that it could be useful to others, used for some time and then went away. Sure, if it brought me 1M€/month I would work on it hard. But it was not the primary goal anyway.

I think authors usually give admin access to active contributors that seem reliable, instead of some random guy who ask for permission without doing much previously...

An attacker would be willing to write a 40 line commit like this guy in order to get the access needed