That’s lovely exploitation. Tl;dr attachments uploaded in draft comments get URLs that look like malware being hosted by Microsoft’s GitHub org. https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/