Outsized reach behind an ordinary-looking account
A maintainer account holds the credential controlling publish access to an open-source package, giving whoever controls it the ability to push a new version that every downstream project depending on that package may pull in — frequently automatically, without individual review of each new release. The account itself is often protected with far less rigor than its actual reach would justify: a package with a modest-looking maintainer count can sit deep in the dependency tree of a huge number of other projects that never directly chose to trust that specific maintainer, and likely never even knew the package existed.
This asymmetry makes maintainer accounts a genuinely attractive target: compromising one ordinary personal account can propagate a malicious change to every project that transitively depends on that package, entirely bypassing whatever careful security review each of those downstream projects applies to their own directly-written code.
A parallel path that doesn't require compromising anyone
Typosquatting achieves a similar outcome through an entirely different route, requiring no account compromise at all: publishing a new, malicious package under a name deceptively close to a popular one, hoping someone installs it by accident, having mistyped or misremembered the real package's name. Both attacks — compromising a real maintainer's account, and simply publishing under a deceptively similar name — exploit the same underlying reality, that most consumers of an open-source package extend a level of trust to it that's never actually been earned through any individual, deliberate evaluation of who's actually behind it.