The developer has reported the issue to GitHub and advised developers to GPG-sign their revisions made to the repository