Update

  • Seems I overlooked the link, describes a new trick or injection to inject bogus commits. Sucks because GitHub will not fix it only thing you can do is check the Commit ID or review the commit history manually.