Not going to comment on the PR commentary, but the victim GitHub account is suspicious itself, recent account, a few fresh repos, following 14.5k others, and I count three surnames on the account (the username, plus two in the README history).
Not going to comment on the PR commentary, but the victim GitHub account is suspicious itself, recent account, a few fresh repos, following 14.5k others, and I count three surnames on the account (the username, plus two in the README history).
I saw a contribution by this maintainer to another user who ALSO HAS 14.5k followers: https://github.com/yumiaura/myCat/pull/99 "yumiaura" and a preference for "my[APPNAME]" repo naming.
What is this?
Are the histories that Github presents all derived from someone's uploaded git repo .. e.g. can I simply claim to have created a GIT repo in 1970, and the "github commit graph" will dutifully represent this claim in its green-colored activity graph?
yes, the github contributions heatmap is known to be open for manipulation. folks will use it to draw art by backdating commits.
if i have it right, only commits can be manipulated, other contributions should be safe — i don't know what is possible for orgs moving old discussion archives into github, see python's issues for reference
see: https://github.com/dspinellis/unix-history-repo
They're almost certainly not genuine accounts, maybe used for karma farming, phishing, social engineering, future malware distribution?