How a Fake Font File Almost Hacked My GitHub

As a developer, I always thought major security scares only happened to big tech companies. Then, it happened to me. It started when I noticed unapproved commits on my GitHub. After investigating, I traced the issue to a frontend project I was working on. It looked normal, featuring standard web assets like font files (latin-200.woff, latin-300.woff, latin-500.woff). But latin-500.woff wasn't a…