There was no pull request that added this code. There seems to have been a game of telephone that led people to believe it was added in a pull request without a

There was no pull request that added this code. There seems to have been a game of telephone that led people to believe it was added in a pull request without anybody noticing it. This isn't true, the commit was pushed directly to master by someone, and doesn't belong to any pull request. According to the AWS report ( https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ https://aws.amazon.com/security/security-bulletins/AWS-2025-... ), the code was pushed by a GitHub token that the attacker gained access to.