Fraudulent Dependabot commits leveraged for malicious code injection

Hundreds of GitHub repositories have been targeted with fraudulent commits purportedly from GitHub's free automated dependency management tool Dependabot in a bid to facilitate malicious code injections and exfiltrate sensitive project data exfiltration, reports SecurityWeek.

automated code code injection data data exfiltration dependabot dependency exfiltration fraudulent free github github repositories injection malicious management project reports repositories sensitive third-party-code tool