there is no nixpkgs maintainer, each package have its maintainers. if you just changed the hash to an incorrect one, nix will show you an error and the package won't be built. if you mean changing the source to a malicious source code, other maintainers or anyone else saw the incorrect source, they will report it and it will be fixed. You can also check the package source by running `nix-edit` command. Also not any change on the packages will be chipped to the stable nixpkgs version, it chipped to the unstable first.