Random pull request on public JS project repos using NPM

This GitHub user is poking around on public repos, seems like trying to find exploits using automated GitHub workflows.

He's opening and closing pull requests (like [this one](https://github.com/deliveroo/merge-pr-to-branch/pull/38)) on projects using NPM, with "test" file changes on \`.gitignore\` and \`package.json\`.

[One PR](https://github.com/npm/statusboard/pull/616/files) seem to have a shell access preinstall script? [screenshot](https://imgur.com/4VV9aKG)

Is this malicious? If it is anybody knows which CVE is this?

automated cve cybersecurity exploits find github malicious npm project public random repos request workflows