[presentation]

Wasn’t part of the problem though that renovate was automatically upgrading people to the compromised hash? Or is that just the fault of people configuring it to be too aggressive with upgrades?

[Arbortheus]

No, someone just impersonated renovate bot and the repo author got tricked