Hi HN, I'm maintaining an OSS project, and someone raised a PR a few days earlier, and since then, 20K+ LoC has been added to the PR. There are two new accounts, but they lack details on how to contact them, only providing usernames.

PR: https://github.com/srbhr/Resume-Matcher/pull/497

Accounts: 1. https://github.com/lololop67 2. https://github.com/ririyoungG

I've also found out from the PR that they're hosting the project somewhere, without any data disclaimer. Since this project is an AI resume builder, the accounts hosting the project can easily extract private data, such as phone numbers, emails, and addresses, and use it for malicious purposes, scams, etc. And that's what I'm more worried about. :(

I never intended to paywall this project. My goal was to provide a local first alternative to some online resume builders, and the accounts are doing the exact opposite, and they've hosted it at: https://gojob.ing/

I've tried commenting on the PR about the features they're working on, but I haven't received any replies so far.

What am I supposed to do here?