Malware was force-pushed into my GitHub repos. Here’s how I found it and undid it

On a Thursday morning, a routine git fetch printed two words that didn't belong: + a500ecd...aaf1a3e main -> origin/main (forced update) I hadn't force-pushed anything. Someone had replaced t