GitHub repos bombarded by info-stealing commits masked as Dependabot (bleepingcomputer.com)

More discussion over here: https://news.ycombinator.com/item?id=37680443