It wasn't actually from a stranger. All evidence points to it being an intentional merge with plausible deniability (see linked thread). The code is from the CTO's nym account and he forgot to change ...
Forgot to swap the GPG key.
Then it isn’t a stranger PR. It’s a name tag. Plausible deniability dies at the signature.
Then it isn’t a stranger PR. It’s a name tag. Plausible deniability dies at the signature.