Also possible that a Lenovo employee was at a coffee shop using wifi connected to the corporate CMS using http"s" and someone unrelated to Lenovo linked their fake repo on his/her behalf.
The account page is using the Lenovo logo. If it isn't them, I'd expect Github to get a takedown request ASAP, especially considering the current situation.
[1] http://support.lenovo.com/us/en/product_security/superfish_u... "Automatic Removal Tool Source code"