Towards the bottom of that page is a tree with all the replies in the chain.

Here is one where they determined it was not malicious by examining the ref logs

https://lore.kernel.org/all/20250601-pony-of-imaginary-chaos-eaa59e@lemur/

I’ve used these tools to remove stuff from git history (e.g. someone accidentally committed a password or key that wasn’t noticed for a while) and they are powerful but scary. Good discussion on what when wrong and how to avoid it or at least notice it before it gets this far