The attacker had 750 previous commits; maybe it was all for this or maybe there are more vulnerabilities.