Actually maybe the attacker was watching commits in github and spotted an XSS fix :) Free vulnerability!