repo

I'm feeling that maybe the entire concept of "publishing packages" is something that's not really needed? Instead, the VCS can be used as a "source of truth", with no extra publishing step required. This is how Go works: you import by URL, e.g. "example.com/whatever/pkgname", which is presumed to be a VCS repo (git, mercurial, subversion, etc.) Versioning is done by VCS tags and branches. You "publish" by adding a tag. While VCS repos can and have been compromised, this removes an entire attack surface from the equation. If you read every commit or a diff between two tags, then you've seen it all. No need to also diff the .tar.gz packages. I believe this would have prevented this entire incident, and I believe also the one from a few weeks ago (AFAIK that also only relied on compromised npm accounts, and not VCS?) The main downside is tha

Well actually you can do it without even adding a remote. git pull https://github.com/otheruser/repo.git branchname so your example will become git pull fork@github.com pr-branch

I don't think this is necessary. The solution is to go to your project's mailing list, irc room, ask your twitter followers, or whatever, and ask for a new maintainer. Even messaging the users who actively report issues can be a good idea. Once you have a new maintainer, announce it, open a support request in http://support.github.com asking them to re-root the network to the new maintainer's fork, and then change the description of your repo (a one click change) to something like "this is no longer maintainer, check http://github.com/otheruser/repo Yes, it takes a while, but then when you solve it, you give the community a new maintainer. So I think it's a better solution than just marking it as abandoned :)