Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit