"Indistinguishable From an Attack"

How an autonomous bounty bot opened a pull request that repointed a core dependency to a fork it controlled