Git Coin Community SPAM

[nuxy]

Discussion Type

Product Feedback

Discussion Content

It seems that Github is now being used as a crypto spamming vehicle.

Couldn't this be mitigated by throttling Issue creation?

[Adit122022]

GitHub’s crypto spam problem is out of control, with millions of fake issues and PRs clogging up repos and notifications. Throttling issue creation—especially for new or suspicious accounts—could help slow the spam flood. GitHub already uses throttling to manage system abuse, so expanding it to issues and PRs makes sensegithub.blog+2.
Right now, spammers exploit the lack of limits, creating chaos before disappearing. Stricter throttling, paired with better spam filters, would give maintainers breathing room. It’s not a perfect fix, but it’s a practical step GitHub should take to protect its community. What’s your take—would this help, or is there a better way?

[pavelnikolov]

I got the same scam email from notification-on/gitcoin.com#97

📌 GitHub × Gitcoin Developer Fund 2025

Dear community,

We are excited to introduce the upcoming phase of the GitHub Developer Fund, a joint program with Gitcoin designed to highlight and support those who strengthen open-source technologies and digital public goods.

Your GitHub account qualifies for participation in this phase. We value every type of involvement — from occasional contributions to long-term commitment — as essential to shaping the future of open source.

Program overview:

Funding approach: Quadratic Funding, boosting community influence through a shared pool
Total allocation: $15,000,000 USDC
Eligibility: Active participation and potential future impact — open to everyday contributors and maintainers, not just project founders
Next step:
To secure your preliminary registration and confirm eligibility, please verify your wallet using Gitcoin Passport. This ensures fairness, protects against Sybil attacks, and never requests personal data. Verification takes under a minute: connect your wallet and sign a message.

Please note:
The authorization requires a refundable deposit, which will be fully returned after the process is completed.

📝 Continue with authentication and submission here:  https://github-foundation [dot] com <-- scam website

[Rishikesh63]

gitcoin-dev/gitcoin.com#24
same here

[d0nda]

always check online if something is legit or not and im glad i did just that 🫡.. and my email is being flooded with the same email

[ChengYour]

https://etherscan.io/tx/0x0c8d46ab00b84d2fd51f69af0dd1eabb3e5a52ed23b68a07c10c93cd896a79e4
I lost $7 😂

[d0nda]

yeah you ain't getting it back as they claimed on the email 😅😅

[ChengYour]

yeah, that was the money I used to buy lunch. Now I have to go hungry at noon.

[Cloudef]

Same scam here gitcoin-developers/gitcoin.com#54

[saghm]

I have an unread notification from git-coin-foundation-dao/gitcoin.com that I can't even see, presumably because the organization is private and I'm (obviously) not a member. My notification list is empty, showing "1-0 of 1" for the range at the top of the list. I've been getting spam about cryptocurrency giveaways for weeks, but I only noticed today that this seems to be coming from within Github.

From looking at the security settings on my account, there's no way to block an organization, only individual users, and I can't block a repo that I don't have permissions to see. The documentation on the support site indicates that to report an organization, I need to navigate to its page and click on a button, but that's clearly not possible when the organization is private. This seems like a fundamental issue with Github's permission model. Either they need to prevent people from interacting with users from contexts that aren't visible to the target of the interaction, or they need to provide a mechanism for users to opt-out of those interactions in some way. Otherwise, they're literally just giving spammers free use of their infrastructure.

[Visual-Studio-Coder]

I don't really understand why everyone's complaining... I just read the email I received in my inbox and I dont have any unread notification problems on GitHub.

[gongfuture]

I don't really understand why everyone's complaining... I just read the email I received in my inbox and I dont have any unread notification problems on GitHub.

Actually, I still have this issue :(

After ran the script by @benjamincburns , these notifications disappeared. Thanks a lot!

[muuvmuuv]

Same yes, I opened a ticket at https://support.github.com/ lets see if they fix that for future spam bots

[cmditch]

Very annoying. I have 9 or 10 of these phantom notifications as well.
You are the GOAT @benjamincburns! Thanks for taking the time to write up that script and share it out.

[mingchau]

thank you! it's finally clean 👍

[bisectracky]

I have a similar issue: git-notify-co/gitcoin-co#446)

[mainrs]

gitcoindev-foundation/gitcoin.com#430

[YogevHend]

I got 2 spam mails recently for gitcoin and something else.

[innocentius]

Currently, I recieve a notification icon from that repo, yet I couldn't see anything, nor can I make the notification go away.

[seyedalida]

@benjamincburns Thanks a lot!

[chandujr]

Why install or run any third-party scripts when you can achieve the same by hitting the Github API directly using curl? Try this:
https://github.com/orgs/community/discussions/174283#discussioncomment-14533335

[funcdfs]

such a stupid bug.

[secustor]

I have run into the same problem and have created a script to delete the notifications for such left overs.

https://gist.github.com/secustor/0b1b881d1db5cf7c83e17b86ee58010b

[benhuang-po]

Awesome, cool. I am speechless. Thank you

[lfir]

Another one repo:gitcoindeveloperdao/gitcoin.com -____-

[saghm]

This doesn't help me at all with the issue I reported above because as I noted, I can't block or report the organization that's spamming me due to it being private. Plenty of other responses here show that I'm not alone in this.

I did get tagged by an additional public one since last night, which I've reported and blocked, but the other one is still there. Given that I have friends and colleagues who have not been spammed like this, it's fairly clear that I'm on some sort of targeted list being used for this sort of thing, and having to try to do Github's work for them to identify this sort of spam is unacceptable. There needs to be a way for me to limit the scope of who is allowed to tag me in arbitrary places I don't care about by people I don't know.

[PPPDUD]

*yawn*...

[rafalohaki]

I hate it grrrrrr

[SHA888]

I think GitHub and Gitcoin should take this seriously by make an official announcement about phising.

[afogue]

Got a notification from gitcoin-dev/gitcoin.com

[mtwzim]

Another one: Gitcoin-Engineer/gitcoin.com#491

[nvrdftd]

Finally, looks like it's been removed

[sultaniman]

Here is another https://gist.github.com/strugurelhendre522-crypto just registered on github and already spreading scam in gists link

[PPPDUD]

That doesn't seem like it's the same attack @sultaniman; it seems like it's just another strange Gist that doesn't do anything.

[sultaniman]

Yeah unlikely they are connected but crypto in such comments now started to trigger me. 🦐

[guest271314]

What would be funny is that was Microsoft/GitHub Copilot gone rogue.

[conglinyizhi]

Thanks for the solution provided by the community (using curl to access the API to control notifications( https://github.com/orgs/community/discussions/174283#discussioncomment-14533335 )) ... but, as a commercial software/service, this is still quite outrageous

Additionally, I've attached the spam repository I pushed so that other future victims can index this topic:

{
  "id": "xxx",
  "title": "Paradigm | $60M GitHub & Paradigm PD25 [Closed pre-registration]",
  "repo": "paradigm-funds/paradigm"
}
{
  "id": "xxx",
  "title": "Gitcoin Announcement | $15M Github Developer Fund",
  "repo": "gitcoinorg/s"
}
{
  "id": "xxx",
  "title": "Gitcoin Announcement | $15M Github Developer Fund",
  "repo": "gitcoincomanager/gitcoinco-dao"
}

[erlend-sh]

I'm also stuck with these ghost notifications.

Really wish there was a simpler fix for this than command line operations.

[Anutrix]

gitcoinnotifypromo/gitcoincodao
gitcoinod/org
gitcoin-member/gitcoin-member

Same issue but with above repos.

Github letting random people be subscribed to repositories they have never even heard of or given permission to, seems like genAI/LLM agents and engineers at their best working on Github source code. Good job Co-pilot at causing this issue.

Making Co-pilot almost impossible to delete just makes the situation worse.

[jxu]

I believe global @ notifications were always the case. I will give them the benefit of the doubt and say they assumed they would be used for good-faith purposes and not crypto scams.

[maifeeulasad]

The question is, how do set the status to that notification as read??

That blue dot is killing me

[debug4ever]

I used emmanuel-ferdman/gh-gonest. Works like magic.

[chandujr]

Did you try this? https://github.com/orgs/community/discussions/174283#discussioncomment-14533335

[southwolf]

But the point is - should it be GitHub's responsibility to do a cascade cleanup of notifications for those deleted repos? I know that could be an expensive operation to find every fan-out notification, but it should really not be done by EVERY user...

[maifeeulasad]

Did you try this? https://github.com/orgs/community/discussions/174283#discussioncomment-14533335

Thanks buddy, it was really helpful!

[PPPDUD]

Are these emails still happening for you all? They've stopped for me.

[oldthreefeng]

export PERSONAL_ACCESS_TOKEN="xxxx"

page=1

while true; do
  response=$(curl -s -D headers.txt -H "Authorization: token $PERSONAL_ACCESS_TOKEN" \
    "https://api.github.com/notifications?per_page=50&page=$page")

  echo "$response" | jq '.[] | select(.repository.full_name != "labring/sealos") | { id, title: .subject.title, repo: .repository.full_name }'

  if grep -q 'rel="next"' headers.txt; then
    ((page++))
  else
    break
  fi
done

bash

{
  "id": "19174168415",
  "title": "Paradigm Announcement | $80M GitHub & Paradigm PD25 [Closed pre-registration]",
  "repo": "paradigm-club/paradigm"
}
{
  "id": "19086820839",
  "title": "Gitcoin | $15M GitHub x Gitcoin",
  "repo": "notification-on/gitcoin.com"
}
{
  "id": "19085595733",
  "title": "Gitcoin | $15M GitHub x Gitcoin",
  "repo": "gitcoincommunity/gitcoin-developer-fund"
}

then delete

curl -X DELETE -H "Authorization: token $PERSONAL_ACCESS_TOKEN" https://api.github.com/notifications/threads/19174168415
curl -X DELETE -H "Authorization: token $PERSONAL_ACCESS_TOKEN" https://api.github.com/notifications/threads/19086820839 
curl -X DELETE -H "Authorization: token $PERSONAL_ACCESS_TOKEN" https://api.github.com/notifications/threads/19085595733

[peerless2012]

The world is clean.

[decentral1se]

Now I have endless ghost notifications from these spam repos 🙄

[aaronwi]

those ghost notifications were driving me crazy, now I finally see what they came from

[patrickleet]

Anyway to remove this???

just here forever now?

[jxu]

Looks like it was finally fixed - my notifications are pristine now

[commandini]

This is the state of Github, folks! This is the state of Internet. Enjoy it.

[nuxy]

commandini And to think that AI is going to somehow make software better.

Cough. Cough. F*CK AI

[maifeeulasad]

@github please lock this conversation as it is already many working solutions! And if you are looking for a greater addition on your engineering team, hire me.

[shinybrightstar]

Hi everyone! 👋

Thank you all for your patience while our team worked on resolving this issue. This problem has now been addressed, you can read more here: https://github.com/orgs/community/discussions/180956

We're locking this discussion as the issue has been resolved and to help maintain a productive and tidy community for all our members.

Thank you for helping us maintain a great community!