I wonder if this has anything to do with the 3rd party software used to compromise drupal.org?