GitHub says the Octopus Scanner campaign has been going on for years, with the oldest sample ... projects or inside major software companies, and not necessarily to poison open-source Java projects.

By default, GitHub will scan manifest files such as package.json (for JavaScript projects), gemfiles (for Ruby projects), requirements.txt or Pipfile.lock (for Python projects), pom.xml (for Java ...