The attack starts with seemingly legitimate GitHub projects — like making Telegram bots for managing bitcoin wallets or tools ...