Threat actors are hiding malicious files in legitimate repositories on GitHub and GitLab by embedding them in the comment section. This allows them to distribute malware undetected.

Cyber attackers use images & built-in tools to bypass defences – SecurityBrief Australia
Cyber attackers use images & built-in tools to bypass defences SecurityBrief Australia