Stream: wasmtime

Topic: issue-tracker spam

Chris Fallin (May 29 2026 at 04:22):

It seems that creativitysurvey on GitHub is using our issue tracker to post spam self-promoting their (non-Wasm) runtime, with minimal customization in each message to purportedly tie it to that issue ("as you're thinking about <TOPIC>, consider our <advertised wares>", likely LLM-generated):

• https://github.com/bytecodealliance/wasmtime/issues/8002#issuecomment-4570439261
• https://github.com/bytecodealliance/wasmtime/issues/10150#issuecomment-4570459958
• https://github.com/bytecodealliance/wasmtime/issues/6094#issuecomment-4570455488
• https://github.com/bytecodealliance/wasmtime/issues/8195#issuecomment-4570485199
• https://github.com/bytecodealliance/wasmtime/issues/11256#issuecomment-4570488960

this seems likely to me to be some sort of CoC violation, or if not, at least a community standards violation. Could we take action to delete and ban? (@Oscar Spencer @Till Schneidereit )

Till Schneidereit (May 29 2026 at 13:09):

yeah, I agree that these comments look more than a bit fishy. I went with the most generous interpretation for now and marked them as off-topic. But if we see more from this account, I think we should move to a ban pretty quickly

Oscar Spencer (May 29 2026 at 15:45):

An hour ago they went and commented updates after we clearly said it was off topic. Probably automated, but I think that's ban-worthy. I'll bring to the broader TSC.

Till Schneidereit (May 29 2026 at 16:00):

we just discussed this and blocked the account for three days. Most likely this'll be the end of it, but we'll immediately move to a perma-ban if anything happens in addition

Pat Hickey (May 29 2026 at 17:22):

I reported one of the posts to github as spam. based on having reported a dozen or so such spam issues over the last few years I expect that in 2-3 months I'll get an update from google that they banned the account in question. they move very slowly

Pat Hickey (May 29 2026 at 17:23):

I cannot possibly imagine that the goal of this campaign is to get anyone to send the author $99 for access to their repository, i'd assume that the goal is actually to get you to execute the .a files in the repo on your machine and get rooted

Till Schneidereit (May 29 2026 at 17:24):

I've been doing that quite a lot, too. In this case at least based on current evidence visible to us (they might be doing this at large scale in lots of repos for all I know), I'd be surprised if gh didn't err on the side of caution

Till Schneidereit (May 29 2026 at 17:24):

yeah, that seems pretty plausible

Last updated: Jul 29 2026 at 05:03 UTC