Comment by pram

Only honest commits by good actors are reviewed. Good for QA but useless for security.

Cryptographic signing is not enforced for commits or reviews, so an attacker that controls a single maintainer Github API key could make a PR with a burner account then "review" and merge their own PR. Time it right and bury it in a dependency of a dependency and you are likely to get away with it. Especially considering they also do not do full source bootstrapping or enforce deterministic builds so including random binary-blobs in tree is a-okay and not sus at all.

The fact everyone is not aware of this is exactly why it is going to work, or already has.

I did once propose to the Homebrew community to enforce commit and review signing but they ultimately refused, worrying that asking people to press a button when it blinks would cause too many definitely smart and useful contributors to leave the project.

So instead they chose the honor system, like NPM.