Ninety-four minutes: how a GitHub release page became a credential thief

Ninety-four minutes: how a GitHub release page became a credential thief, and what pinning...