[rwth-security] Clever 'GitHub Scanner' campaign abusing repos to push malware