It was good to point it out. I only knew what I do about this because I work in this industry. This strategy of trying to compromise people through modified clones is a constant thing. What was notable in this case was the original tweet claiming huge numbers like it was something new, and it went viral.
Something worth noting for people working on github. An extension of this strategy is for the attackers to open PRs, with the compromising code, back to the original repo hoping that a maintainer will assume that a forked repo represents a good faith development effort and fail to fully review the code and merge it. At that point, the core repo is compromised.
It’s always important to fully review code before you merge.
