See this other top-level comment: https://news.ycombinator.com/item?id=49207498

The github page links to web.archive.org, the malware was caught immediately, and in response it lied about the merge request contents. Then came the second account where the social engineering came in. The string of comments trying to prove itself without waiting for replies is suspicious itself to me.