HN Explorer

Ask HN: Is anyone else getting spammed via GitHub recently?

105 points by aeharding ↗ HN
Earlier today, a number of people I know have been spammed via GitHub issues and discussions, using @-mentions. Push notifications and emails sent. Very annoying because the report process for spamming on GitHub is not that quick.

35 comments

[ 5.9 ms ] story [ 70.1 ms ] thread
LinuxBender
Yes. I nuked my GitHub email canary. The spam comes across as a mail-list thread with a thread ID.
nop_slide
Yep I literally just got one 10 mins ago and saw this thread.
david_allison
Yes, I contributed a small documentation fix to a service. I'm now assumed to be a maintainer and users tag me in issues whenever the service goes down.

These issues have hundreds of replies, and GitHub has UX problems on large issues: comments you're tagged in aren't immediately visible, which discourages reporting (it may take ~2/3 minutes to expand a conversation to find and report it).

It discourages future contributions to repos I don't maintain.

version_five
What kind of repos is this happening for? Like is it targeting personal projects, contributions to bigger open source projects, or something else?
schemescape
For me, it was a reply to a thread I started on a big corporate repository.
bmitc
I got two of them today, one after the other. One was for a discussion or issue I had previously commented on, but one was another repository I had never interacted with in anyway. GitHub removed one before I could report it, and I reported the other one. Both comments @ing me and the users have been removed now. I'm wondering if they got hit by something or if some part of their spam detection system wasn't working. It wasn't clear what the rubric was for having my name @ed by the spammers.
4silvertooth
Yes, I got it just now, I haven't stared that repo, or have any mentions.
codegeek
Yes got it an hour or 2 ago. Totally unrelated and no idea how I got tagged.
TranquilMarmot
Yes! I was disappointed at how many steps reporting the malicious user took. I think it was like 10 clicks to finally submit the report, almost like they wanted to make it difficult.
bmitc
I was surprised at that as well. And there ended up not being a category that even fit the use case of a spam or phishing comment. I just chose the one that seemed to apply to spam or phishing code.
mtmail
Well there's a dozen types of categories. First report took me 5 minutes, then I was down to 1 minute. Instead of writing a comment/justification I copy&paste a screenshot. Got a reply within 30 minutes and all spam got handled. I think that's faster and more straight forward than other platforms.
cjk
Yep. First time I’ve seen anything like that on GitHub.
metadat
Yes I also got one today.

Couldn't find any "report spam" or "report post" link.

kleer001
> Couldn't find any "report spam" or "report post" link.

I saw that lack too. In a way it felt warm and nostalgic for a earlier, more naive, time of the internet.

But yea, we need that.

ssss11
Oh, I thought the hot chicks were really for me…….. damn you github (and fb, email, TikTok, Twitter and so on….)
meken
Yes I got my first ever GitHub spam today :(
blahblah1234567
Yep.

The content of the email was:

" Message me when you are free https://to.sv/SomeUUID

<list of about 40 users w/ @ sign preceding their github handle>

Hey All my photos and videos here https://to.sv/SameUUIDAsAbove "

Very suspicious. I searched the URL on a malicious link lookup site and found "7 security vendors flagged this URL as malicious"

jeremycarter
Did you manage to download all the photos and videos? Just asking for a friend of mine...
lfconsult
Got exactly the same content schema.
signaru
Got one, the links and repo look legit (on first glance at least). But I have absolutely no idea why I am cc'ed on it.

I'm replacing the specifics with words in "<>", but here's the title of my mail from notifications@github.com:

Re: [<user>/<repo>] <what looks like an issue title> (Discussion <#number>)

GabeIsko
Happened to me a few days ago. Added to a korean github, a lot of repositories that are called "pre-onboarding" or something. Anyone know what is going on?
rpigab
Yes, on a random discussion about editing the README I never interacted with, on a repo I like (BurntSushi's ripgrep) but do not remember interacting with, no star, no follow, no fork or anything else from me (I should star it and interact though, it's awesome).

A lady mentionning something getting wet, many mentions including me and the same type of link others mentionned.

burntsushi
Yeah I was deleting many such comments from the ripgrep tracker. At some point though, GitHub seems to have gotten wise to it and is deleting them before I can even get to them. (They still show up in email though.)

I agree with others that GitHub's reporting process for this kind of behavior is not great. It's good to make reporting take a few steps for cases involving real humans, but for obvious spamming or trolling, there should be a quicker way IMO.

EDIT: I also just got a phishing email saying "Your github account was successfully signed in to but we did not recognize the location of the sign in. You can review this sign in attempt by visiting the link below."

lfconsult
Yes, just happened this morning... First, I received a GitHub notification without tag (I even didn't know how is it possible) then I was tagged in a comment to a README "I’m completely nak*d Wanna see the photo" plus a link (obviously)...

Edit: It's in the "Discussions" GitHub tab.

Edit: Got a GH response:

"Our review of the account(s) and/or content named in your report has concluded. We have determined that one or more violations of GitHub’s Terms of Service have occurred and have taken appropriate action in response."

trashface
Same for me. Onlyfans and github have merged I guess.
kobaroko
Is there some setting in GitHub to prevent this messages from coming?
elforce002
Yes. Yesterday. It was right after I commented on an issue. This is the first time I get that. The interesting thing is that the spam had users that didn't comment on the actual issue.
sambhu
Yes, with random GitHub users mentioned and link to some adult malicious site