This problem can be solvable by introducing “Verified Identity” on GitHub. Anyone who wants to be maintainer of popular project can be asked to get Verified Identity. If this person turned out to be malicious, he risks getting tracked down by law enforcement fairly easily. For getting Verified Identity, simplest thing might be validation of phone number. Bit more complex thing might be Verified bank account or credit card. Assuming GitHub has 1M active users and each user verification costs $5, the cost of solving this problem is less than 0.1% of GitHub valuation but can hugely improve trust levels.