Huge kudos to Mike for handling this attack and appropriately contacting the maintainers.

I’m also glad to see yet another case where having Trusted Publishing configured would have prevented the attack. That’s a cheap defense that has proven effective once again!