NEW GITHUB REPOJACKING METHOD FOUND

Summary from the TLDR InfoSec newsletter

Researchers from Checkmarx discovered a new method to exploit a race condition in the GitHub retired namespaces protection process to repojack popular repositories. Repojacking is an attack where an attacker sets up a malicious mirror of a GitHub repository that was renamed with the goal of impersonating the old repository. To prevent these attacks, GitHub enabled a protection to automatically retire popular repository namespaces when they are renamed. However, attacks such as this one bypass this protection.