Comment by TZubiri

github.github.com? Not the first time github does something highly weird with their domains (like publishing docs from a subdomain of their public github pages service)

I think they have a culture of circumventing 'official' channels and whoever is in charge of a thing is whoever publishes the thing.

I think it's a great way to train users to get phished by github impostors, if tomorrow we see an official download from official.github.com or even official-downloads.github.io, sure it's phishy, but it's also something that github does.

It's also 100% the kind of issues that, if it happens, the user will be blamed.

I would recommend github to stop doing this stuff and have a centralized domain to publish official communications and downloads from. Github.github.com? Come on, get serious.

TL;DR: DO NOT DOWNLOAD ANYTHING from this site, (especially not npm/npx/pnpm/bun/npjndsa) stuff. It's a Github Pages site, just on a subdomain that looks official, theoretically it might be no different from an attacker to obtain access to dksabdkshab.github.com than github.github.com. Even if it is official, would you trust the intern or whoever managed to get a subdomain to not get supply chained? github.github.com just think about it.