We learned from the past litellm security incident that there are tons of compromised/fake GitHub stars (which was known from the past due to the star farms)
I don't see vibe coders trying to push PRs in good faith in a old emulator. Could it be that the sheer amount of PRs and eventually a bad PR in the middle is being used to compromise repositories?