Following https://news.ycombinator.com/item?id=47450142 which reported brief compromise, it sounds like the Aqua Sec estate is still compromised.

Aqua Sec have disabled push to many of their repos while they continue to address it.