That bot-to-bot PR is terrifying. A ton of maintainers who inherited old projects are starting to just hand them over to bots.
Some of these projects are upstream dependencies for tons of existing codebases and it's only a matter of time before a bot tells another bot "LGTM" and starts merging code that blatantly steals info. Especially for projects that are known to be part of CI/CD or build tooling that no one ever really looks at.
Another reason to only use the standard library and a small subset of trusted packages that you have audited/follow...