My 8-Year-Old Open-Source Project (Neutralino.js) was a Victim of a Major Cyber Attack

Minor bit of advice... linting and formatting as a pre-commit and pre-release sanity check can help to spot these things...

If your release lint/format changes any files, then fail the release, you had raw commits that bypassed checks.

At least this way you can better spot malware additions to files before they get into the repo... this doesn't help against upstream attacks, but can at least help you spot these things... I set my max line length to 120 (what I tend to see on the screen when editing).