A Microcosm of the interactions in Open Source projects
Some background on how the xz backdoor situation arose.
Open Source Maintainers Owe You Nothing
A reminder that FOSS project developers owe you nothing, at least under the license. The only way you're ever owned anything is if they've directly contracted them.