Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit

I ran git pull , then npm run build . That was all. I didn't open any suspicious file, and I didn't install any new package. Even so, the moment the build runs, malware starts and opens a connection t...