Hacker News Reader

Funnily enough I'd assume that those projects would be immune to this type of attack unless the automation is absolutely terrible.

Presumably an automated merge would be checking something like

> if: github.event.pull_request.user.login == 'dependabot[bot]'

No, the automated workflow would be something like this:

- Run dependabot workflow (outputs: $pr_number)

- Automerge $pr_number

projects with underpaid and outsourced contractors by any chance?

More likely, simply open-source projects.