Supply Chain Attacks via Github.com Releases
seclists.org