WALLET ATTACK COULD STEAL SECRETS WITHOUT A MERGE Six malicious pull requests targeted Vizor and Zingo; none was merged. The campaign paired a build-time credential stealer with instructions telling AI reviewers to ignore uploads. Read more here: