Agents hooked into GitHub can steal creds – but users haven't been warned | Hacker News Reader