Malware hidden in whitespace
It asked a blockchain where to phone home
A live payload found in a public repository by our own linter, hidden past several hundred spaces on a line that looked finished, resolving its command and control address from an Ethereum transaction. What it did, why grep and code review both missed it, three checks you can run on your own tree, and the part where our own report hid the finding from the reader.