Most of them don't seem to come from pull requests, I wonder if it's paired with a bunch of compromised github accounts?