what comments?

Ah, I think the HN post was merged. My original comment was in response to this related github discussion: https://github.com/aquasecurity/trivy/discussions/10420

There are hundreds of automated spam comments there from presumably compromised accounts. The new OP is much more clear regarding what has happened.