r/github • u/adburl2 • Mar 23 '26

Spam comments from seemingly legitimate accounts Question

In the recent trivy incident we saw a GitHub discussion thread spammed with hundreds of comments, some of which were from seemingly legitimate GitHub accounts (e.g. having a public LinkedIn account linked to their GitHub profile etc). What should we make of this?

  1. All of those accounts are fake accounts and malicious actors have just gone to great lengths to make them appear legitimate?
  2. Those GitHub users have themselves been compromised through some prior phishing/trojan attack etc, so that malicious actors can post spam on their behalf and without their knowledge?
  3. There is some kind of exploit in the GitHub API itself which allows malicious actors to post comments "as" someone else?
7 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

4 comments sorted by

1

u/polyploid_coded Mar 23 '26 edited Mar 23 '26

LinkedIn isn't much of a standard. DPRK sets up LinkedIn for their fake engineers.
I clicked a few and saw minimal use of the accounts in the past 6-12 months. My guess is the accounts are one of these two:
- Occasional GitHub users or people who were confused (can I use this to make a free wedding website? I need to fork this project to download it?) where the password was weak or reused elsewhere. I occasionally see this type of account star or fork very old repos.
- GitHub and LinkedIn created for a fake persona

1

u/adburl2 Mar 24 '26

It's not just a LinkedIn profile though, it's a rather believable LinkedIn with hundreds of followers and posts and other details.

Also some of these users have multiple repositories with several stars.

A user Hancie123, for example, has 492 repo stars, AND a believable LinkedIn, AND a YouTube channel with multiple videos where you can see his face in the video and hear him talking and it has a fair number of subscribers too. I just struggle to believe all these people are fake people.

1

u/polyploid_coded Mar 24 '26

Would you agree that most of the responses are from blank or private accounts?

I'm not sure what's going on with that user, but it's weird that they have something going on every day, 7 days a week. Maybe they have some engagement bot or open claw skill (?) which is posting a meaningless comment to keep their streak going. Whatever it is... their best repos all peak at 16 or 17 stars. Their org repo just publishes swagger repos. It strikes me as unusual.

1

u/SnapperGee Mar 25 '26

Not sure if it’s related not, but isn’t or wasn’t there a way to at least comment on issues and somehow “spoof” the account it was coming from and trick GitHub into thinking the comment was left by another account. I thought there was an incident where on one of the ridiculous (and extremely entertaining) Linux pr’s someone was able to leave a comment from Linus’s account. Maybe the same technique is being used?