malicious repo confusion