Steve PurcellFirst example we at MELPA have seen of an #emacs package getting hacked (upstream of us, in GitHub): https://github.com/kubernetes-el/kubernetes-el/issues/383
If installed, loading this compromised #emacs library would trigger the embedded shell command. Not very subtle, but this should be a reminder to the dev community that plugins for even niche dev tools can be an attack vector.
Great tips from @tarsius on how to reduce the risk of your GitHub actions being hacked like this: https://www.reddit.com/r/emacs/comments/1rowm5i/comment/o9hxc10/