[richbell]

> I looked through the git history, but nothing seems awry.

Git history or GitHub event history? You can easily push a malicious commit forged to have the same author and short hash.

[nfriedly]

Good point. I only looked through the git history initially, but I've now looked through both. Same conclusion.