Compromised accounts. The malware targeted ~/.git-credentials.