github's supply chain security is a joke. a whole article about invisible code doesn't surprise me. https://www.reddit.com/user/BiggieCheeseFan88