Hacking open source repositories

[bicycleguy]

Was wondering if people are aware of this activity: TeamPCP hacking GitHub

Scares the heck out of me. Seems that lately a lot of big sites are having issues. They specifically mention PyPi repositories. Teensy sure has a lot of exposure to GitHub. Hope it's being watched? checked? or whatever.

Maybe I should stop constantly updating my Arduino libraries?

 

[jmarsh]

The way these sort of things usually work is that they fork a popular repository (not using the built-in github fork functionality but cloning it manually) and poison the release downloads with malware. Then they force-push empty changes multiple times a day to make the repository seem like it has a lot of activity, which makes search engines more likely to return it as a result when people search for it.
There's no real risk of this infecting existing arduino libraries.