You could, but now you're just forcing the attackers to fork an existing project and push some nonsense code to it before they can attack.