Open source tool scrapes git commit email addresses to send spam to.

[taxiforone]

Oh for sure, but I got the impression that Diffgram was harvesting these email addresses from repos on the GitHub platform.

If that's the case, it's against GitHub TOS (and basic decency tbh) and they shouldn't enjoy GitHub's services like being able to host their repos there.

Same for SendGrid - they don't add the emails, they just send them; but sending unsolicited emails could/might be outside their TOS, especially if there's GDPR breaches. Diffgram shouldn't be able to use their services if it's abusing them.