[snailmailman]

Are the spam comments all from compromised accounts, presumably compromised due to this hack?

I only clicked on a handful of accounts but several of them have plausibly real looking profiles.

[bakugo]

Some of them were likely already compromised before these incidents, here's one of the accounts near the top making malicious commits to its own repository before the first hack:

https://github.com/Hancie123/mero_hostel_backend/commit/4bcb...

[wswin]

what comments?

[snailmailman]

Ah, I think the HN post was merged. My original comment was in response to this related github discussion: https://github.com/aquasecurity/trivy/discussions/10420

There are hundreds of automated spam comments there from presumably compromised accounts. The new OP is much more clear regarding what has happened.