Saw it on some repo as well. Reported the user. GitHub Support already took action.
Unfortunately, since this is IMHO mostly "attacks" people who have email notifications turn on, the "damage" will already have been done.
During a wave of spamming obvious exploits via GitHub issues, I reported several of them and even got a response from the security team (after a few hours).
But the issue with the exploit were not removed for days (stopped tracking after a week or so).
Comments
tbh i'm not sure why there are scammers doing this
Unfortunately, since this is IMHO mostly "attacks" people who have email notifications turn on, the "damage" will already have been done.
Hopefully it's not some research paper thing... 🙄
This social engineering vector is all the rage right now (and a big way supply chain attacks occur ).
- last issue opened 2 hours ago
- Render hoster site already blocked
- they've stopped at 5.5k issues (less than half than the previous time)
But the issue with the exploit were not removed for days (stopped tracking after a week or so).
GitHub is becoming the Windows XP in security