Yes. It was probably a maintainer's creds being compromised. The [malicious commit is masquerading as a commit from Renovate](https://github.com/tj-actions/cha

Yes. It was probably a maintainer's creds being compromised. The [malicious commit is masquerading as a commit from Renovate](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67#diff-3d2b59189eeedc2d428ddd632e97658fe310f587f7cb63b01f9b98ffc11c0197R2999 https://github.com/tj-actions/changed-files/commit/0e58ed867...)((https://github.com/apps/renovate https://github.com/apps/renovate) but it's not a `verified` commit (and so it's trivial for a bad actor to masquerade as them). https://stackoverflow.com/questions/67609381/why-do-all-my-github-commits-show-as-unverified https://stackoverflow.com/questions/67609381/why-do-all-my-g...