Echoes in the repo

Pushed a tiny update to a private repo tonight. Minutes later, I got an alert: another push, same repo.

Only I hadn’t made it.

The diff was identical to mine, except for one extra line in the code:

// you’re being watched 

The commit came from my account. My keys. My machine.

I checked the git log, and it was flawless. Same GPG signature, same timestamp as mine. Like it had been inserted in the same moment I committed. Not a clone. Not a fork. A hijack.

Git log:

[08/14/2021 00:42]  
COMMIT: abc7d2 -> push detected from local keys  
DIFF: matches local except added comment  
STATUS: unauthorized commit  

Someone is ghosting me. Mirroring me. Using my own identity against me. If they can be me in the code, what’s stopping them from being me everywhere else?