It's all irrelevant. The attacker social engineered their way to being the lead maintainer for the project.