Comment by muppetman

How would code like this make it into so many repos? People accepting pull requests and not properly reviewing them? Or is there something even worse about this attack?