a fake bug fix PR hid a credential stealer in astro.config.mjs that used blockchain to receive commands