Make a title for this article (do not wrap in quotes or use semicolon or weird characters):

GitHub projects have recently faced attacks through malicious commits and pull requests aimed at inserting backdoors. Exo Labs, an AI and machine learning startup, was one of the targets, raising questions about the attacker’s actual goals.

On Tuesday, Alex Cheema, co-founder of Exo Labs, alerted everyone about a seemingly harmless code modification submitted to their GitHub repository. The pull request, titled "clarify mlx requirement for deepseek models," sought to alter the models.py file by adding a series of Unicode numbers. These numbers, which represent characters, turned the plain Python code into its numeric equivalent using a straightforward method by the submitting user.

This sequence, "105, 109, 112, 111, 114, 116,..." translates to a code snippet attempting to connect to evildojo(.)com and download a "stage1" payload. If the change had been approved and merged, it could have resulted in users of the product executing code from this URL, creating a functional backdoor.

However, when BleepingComputer attempted to access the link, it returned a 404 (Not Found) error. Others who tried accessing the URL also found no content. This makes it unclear what the true intention was.

The commit was attributed to a now-deleted GitHub user, "evildojo666." Both the GitHub username and the domain, evildojo(.)com, were linked to Mike Bell, a security researcher from Texas, who denied involvement in the commits. Bell suggested someone was impersonating him, submitting malicious code to tarnish his name, insisting "there was never any payload...why do people keep assuming there was?"

Bell’s explanation seems plausible since anyone can easily create a GitHub account impersonating someone else and submit code changes. The absence of the "stage1payload" page further suggests the domain never served malicious content, indicating a possible smear campaign against Bell.

Another deleted GitHub account, "darkimage666," was identified by Malcore, a malware analysis platform, as also impersonating Bell to spread backdoor commits. Bell expressed his frustration, noting that people were being caught up in someone else's dispute with him.

Social media users like ChrzanKong noted other projects targeted by similar commits from different GitHub users. Threat intelligence analyst vx-underground reported that "yt-dlp," a popular open-source tool, was also targeted, with Malcore identifying at least 18 similar pull requests against other projects.

BleepingComputer noted that many malicious commits and associated GitHub accounts, some seemingly based in Indonesia, have since been removed. Google engineer Bogdan Stanga recreated the pull request to test Presubmit's AI Reviewer, which swiftly flagged the change with a "critical security" alert.

This incident, though thwarted early, is reminiscent of the recent xz supply chain attack, highlighting how easily malicious code can be introduced into trusted open-source libraries by bad actors. Open-source maintainers are advised to rigorously examine incoming pull requests through automated tools and detailed human review, even if they appear to come from seemingly trustworthy contributors.