Dependabot impersonation

Attackers used stolen personal access tokens to push commits faked to look like automated Dependabot contributions across hundreds of public and private repositories. They added a hook.yml workflow file that shipped GitHub secrets to an external server on every push, and appended obfuscated JS to every .js file in the project to harvest form passwords.

Reported by: Checkmarx noted that PAT activity logging was only visible to enterprise accounts at the time