I guess you've made it when hackers are writing malware in your engine.
Has this type of attack been done with other game engines?
Is there a list of confirmed dodgy repos?
The cp<r> article doesn't go into details but it implies what I immediately figured it was: pirated paid Godot plugins and assets, distributed via discord and the like.
That's a relief. I made some contributions to a free repo that I use, and got a bit suspicious - I wouldn't want to be a part of any club that would have me as a member.