I created a new GitHub account and a private repository, then made an initial commit through VS Code. My commit shows my name, but an additional commit appears immediately afterward with no code changes and is attributed to an unfamiliar GitHub user from another country. That account has existed for years and contains several projects. I deleted and recreated the repository three times, and the same thing happened each time. There is nothing sensitive in the repository, but I would like to understand how this attribution could be occurring.
2 Answers
Check your local Git configuration. Git records the author name and email stored in settings such as `user.name` and `user.email`; those values are separate from the GitHub account used to authenticate the push. If the configured email belongs to, or matches an email publicly associated with, another GitHub user, GitHub can link the commit to that profile. Check the configuration with `git config --list` or `git config user.email`, then correct it if necessary.
The unfamiliar profile may not actually be an extra person making changes. GitHub associates commits with accounts based largely on the email address in the commit metadata. If that email was copied from an old setup or is shared with another account, the commit can appear under that user's profile. Also compare the commit history and hashes to determine whether there is truly a second commit or just an attribution/display issue.
So the first thing to check is the name and email configured in Git on the computer, rather than assuming the GitHub login itself was compromised.