Hackers can spoof commit metadata to create false GitHub repositories

Checkmarx security researchers have warned about an emerging new supply chain attack tactic involving spoofed metadata commits to present malicious GitHub repositories as legitimate.