GitHub comments abused to push malware via Microsoft repo URLs