We're trying to figure this out, we've nailed it to the developer machine but not sure how that machine got infected. Possibly through GHA.