On: GitLab discovers widespread NPM supply chain attack

[hiccuphippo]

Pushing the data to Github was a blessing in disguise. A friend wouldn't have noticed he got caught if it didn't create a repo on his account. It would have been worse if it silently sent the data to some random server.