Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

third-party[.]com was never IANA-reserved. Anyone could register it, and someone did 😅 It appears in 1,700+ public GitHub repos, mostly in AI agent skills and MCP server docs as a harmless-looking placeholder, and since at least June it has been serving ClickFix: a fake Cloudflare check that poisons your clipboard with PowerShell. Manifold found 13 more squattable placeholders. Use example.com - that is literally what it is for.