[krisbolton]

100%. I can't find it now, but someone last month posted a similar story on HN. The threat actor had stolen someone's GitHub account and altered their otherwise legitimate looking repo. They'll expend a lot of effort in order to masquerade and trick you. TraderTraitor is another good DPRK example.

Anyone reading - if you're ever a victim, worth reporting to your national CERT and your org. The CERT can provide advice, it's useful for their threat intel, and your org can check their systems. You might not be the end target.

[marysol5]

Again, you don't need to be a "Nation State" to think this up, and then implement with a few scripts and a bit of LLM.

Some 13yo kid with a VPS could do it