> Edit: one of simple improvements github/other forges could do is show content of archives in a diff. That works if the archives are valid as checked in, but

> Edit: one of simple improvements github/other forges could do is show content of archives in a diff. That works if the archives are valid as checked in, but not if they’re corrupted in a predictable way such that they can trivially be “un-corrupted” as needed, perhaps by something as simple as tr. Even if that’s not exactly what happened here, I think it’s pretty obvious how eminently doable that is, given the sophistication of so many aspects of this attack.