The attack starts with seemingly legitimate GitHub projects — like making Telegram bots for managing bitcoin wallets or ... attackers hide nefarious script after a bizarre string of 2,000 ...