Of course, as the old saying goes, explaining a joke is like dissecting a frog: nobody laughs and a frog dies.
My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and have a significant adoption rate but are not actively maintained. We are talking about Colors-like and Faker-like projects. All you need to pull this off is posting one message asking nicely for permissions, post a commit, and make a release.
If you believe amusement is a disservice to the community then I believe many others disagree.
edit: For clarity, the "since inception" part is an absurd setup for the, equally absurd, "well funded open source" part.
There is an extreme lack of sense of humor around these parts.
I lol'd, and thank you for that.
I'm not sure you read the article, but the example that's presented right at the start consists of a potential bad actor asking project owners of established popular projects to assign them as maintainers.
It's not from inception. It's capturing existing projects.
I feel this problem is more serious than what you're making it out to be. I know for a fact that this works very well, as I was already added as a maintainer to popular albeit dead projects. In one case I was even added as a maintainer even though I had zero contributions and I had just created an account on the platform that hosted the project's official source code repository.
You have whole organizations focused on exploiting software vulnerabilities throwing huge volumes of resources to find backdoors, and in the end all you need to do to add your own backdoors is ask to be handed the keys.