The "wfx-loot" attack, in which hijacked GitHub accounts submit pull requests (PRs) titled "docs: dependency audit notes" to ...