The GPT Pilot GitHub repository documents a supply-chain worm/credential-harvesting issue that was present from August 2025 until it was removed on 2026-06-11; users are advised to rotate exposed credentials if they ran the code during that period.
Source