Yes, this has happened. See this example from OpenJSF: "The OpenJS Foundation Cross Project Council received a suspicious series of emails with similar message

Yes, this has happened. See this example from OpenJSF: "The OpenJS Foundation Cross Project Council received a suspicious series of emails with similar messages, bearing different names and overlapping GitHub-associated emails. These emails implored OpenJS to take action to update one of its popular JavaScript projects to “address any critical vulnerabilities,” yet cited no specifics" [0,1]. [0] https://openjsf.org/blog/openssf-openjs-alert-social-engineering-takeovers https://openjsf.org/blog/openssf-openjs-alert-social-enginee... [1] https://www.schneier.com/blog/archives/2024/04/other-attempts-to-take-over-open-source-projects.html https://www.schneier.com/blog/archives/2024/04/other-attempt...