[ImPostingOnHN]

The repo looks like it uses itself in its workflows, so it's possible that the commit being merged resulted in the necessary credentials being leaked to the attacker.

[rognjen]

There doesn't seem to be a PR for the commit though.