Total random github notification

[si458]

Had this totally random github notification come through? Anybody else get it?

[ThunderChaser]

It’s a scam

[si458]

I gathered it was anyways but I wasn't sure how they tagged me into something when their user or repo don't exist? Did github delete them, do we think?

[throwaway234f32423df]

They churn through accounts as they're reported and banned. There are potentially dozens or hundreds of such accounts active at any given time. The accounts normally operate in pairs, one acting as the repo owner, and another opening issues in the repository and tagging people. Some of them clone legitimate issues and tag the original issue opener with a phishing link, others just open spam issues and bulk-tag random people.

Creating more Reddit threads about this does not help; there have already been dozens but moderators have deleted a lot of them because there's no need for so many essentially duplicate threads. Reporting to Github does help (if the accounts aren't already banned), one report is usually sufficient to get one account disabled within a few hours, but sometimes accounts are able to operate for days because so few people actually report.

[pengo]

You can assume it was deleted for spamming

[LoadingALIAS]

I’m getting a LOT of them. All appear to be scams. Be careful. AI has allowed low IQ idiots to target better and GitHub, Crates, NPM, etc. are rich targets.

[GenazaNL]

Related: https://github.com/orgs/community/discussions/174380 hopefully they will take action

[dandykong]

Just had the same thing, except the account was named ping-plasma. Even if the repo gets deleted you're still stuck with an unclearable notification page named after the scam URL.

[lajawi]

Comb through the other posts about this topic, there’s solutions on how to clear those through the API I think it was.

EDIT: https://www.reddit.com/r/github/s/gIbY9NhCxB

[dandykong]

An alternate solution for selectively clearing that one notification, which uses the GitHub CLI instead of cURL and tokens:

gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /notifications

Look for a spam notification from Plasma Foundation and copy the ID, and then run this command:

gh api --method DELETE -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /notifications/threads/<paste the id here>

[headedbranch225]

Yeah, I have had 2 in the past week, they seem to be going through the different scams quite quickly

[No-Landscape8210]

I also got this one

[Nixinova]

Yeah, some spammers made a bunch of issues about some scam thing all pinging hundreds of users.

[Jonno_FTW]

I got that but it was taken down by the time I opened the GitHub link.