This type of attack is going on for few years now. I had 2 in my credit.

Some details https://freebird.in/malicious-code-source-code-shared-via-jo...