That fork is only five commits ahead of the upstream fork, with a bunch of release tooling updates. At a glance, it doesn’t look like there’s anything shady there, but it would be nice to know of folks using it in production and verifying that’s it’s not malware before we recommend it.
We should do something before the Django 7.0 branch is cut in January. If no one can vouch for pylibmc2, I think we need to deprecate all of the memcached clients, and we should do that in Django 6.2.