PASSWORDS

Summary from the TLDR InfoSec newsletter

A threat actor is using an alias of GitHub’s Dependabot feature to install password-stealing malware. By mimicking the Dependabot, which automatically scans projects for vulnerabilities, the attacker has convinced users to accept malicious commits.