Microsoft controls NPM and GitHub. I would not put it past them to truly take over a project if they gauged it in their best interest (though it would be a massive violation of trust, so I'd imagine they'd tread carefully before going there).

If it's sent to Akrites, they can even pretend it's done responsibly – even though only megacorps get a seat around that table.