On: Malicious code added to 35k GitHub repos, leaking ...

[jwilk]

I think you want git-notes (or something similar):

https://git-scm.com/docs/git-notes

"Adds, removes, or reads notes attached to objects, without touching the objects themselves."