Dudes, saw that ???
Apple was notified on October 17, and as of October 28, the developer tools on macOS, git included,
still trust the compromised certificates
To check whether your git is affected, run:
bash
git ls-remote https://git-emudhra.we-have-a-problem.com/check.git
commit 473476d