The username is literally "evildojo666"

It's not, I think the headline is for clicks and engagement.

Looks like he accidentally added a file. It's not "innocent" but definitely disguised by appearing as a readme only change

Even the PR is described as just a docs change

No injection here, purely functional programming