My guess is that skywhopper is correct. We're only able to see the tail end of the attack, but the repo was likely compromised in some way.