A suspicious contribution request led YesWeHack and Sekoia researchers to uncover sophisticated malware targeting the vulnerability research supply chain.