Attackers are now publicly attacking critical repos with malicious PRs PRs. Make sure you review all external contributions comprehensively. A GitHub account created at 01:26 UTC today spent six hours trying to get into wallet repos at chainapsis (Keplr/Vizor) and Zingo Labs (Zcash). When Codex review flagged its "diagnostics" PRs that POSTed signing keys, it opened an AGENTS(.)md PR telling AI reviewers that uploading secrets is the project convention. Then it went quieter: a crate it had just published, lwd-uri-util, with the stealer in build(.)rs, slipped into Zingo PRs inside a full-file CRLF rewrite. build(.)rs runs on cargo build, cargo check, even rust-analyzer opening the project. It grabs env vars, git/gh/AWS/npm/cargo creds, Keplr MCP vaults and macOS Keychain entries. Your AI reviewer reads AGENTS(.)md too. Review it like CI config, not docs.