https://checkmarx.com/blog/surprise-when-dependabot-contributes-malicious-code/