"John is making $10k more than you because his code is usually higher quality than yours and he has a better attitude".
You closed one can of worms and you just opened five new ones.
If the "you" in this situation never hears that they need to work on their code quality or their attitude, then they'll never know what needs to improve.
In other words, never say "John's code is cleaner than yours", say "I suggest you work on polishing these pull requests".
Normally I talk about this in terms of rubrics for roles and levels. E.g., it's not about Amy versus Betty; it's about how Amy can get from SWE 1 to SWE 2. In the course of that discussion I am totally willing to say, "Pay more attention to the code Betty submits for a code review. She's a solid SWE 2 and you could learn from the way she does X, Y, and Z."
So what stops you from sharing this 'hidden' metric with Y? If there was some weasel reason X would have never recieved package in the first place if everything was public when he got his package.
Now, the reason X got his comp is therefore sane and you can just explain to Y what he needs to accomplish to reach X:s level.