The metadata that developers look at when deciding whether to use an open source project on GitHub can be easily forged and gives attackers a way to trick users of the platform into downloading ...