Why some attribute names start with double underscore in JavaScript?

I believe the answer needs an update. These names are now part of ECMA-262, so yes, the naming convention is now defined in ECMAScript specification.

Starting from ECMAScript 2015 (ES6), the following has been standardized*:

• B.2.2.1 Object.prototype.__proto__

Starting from ECMAScript 2017 (ES8), the following has been standardized*:

• B.2.2.2 Object.prototype.__defineGetter__( P, getter )
• B.2.2.3 Object.prototype.__defineSetter__( P, setter )
• B.2.2.4 Object.prototype.__lookupGetter__ ( P )
• B.2.2.5 Object.prototype.__lookupSetter__ ( P )

*: It should be noted however, the sections listed above are all defined in Annex B "Additional ECMAScript Features for Web Browsers", and a note accompanying Annex B reads (emphasis mine)

This annex describes various legacy features and other characteristics of web browser based ECMAScript implementations. All of the language features and behaviours specified in this annex have one or more undesirable characteristics and in the absence of legacy usage would be removed from this specification. However, the usage of these features by large numbers of existing web pages means that web browsers must continue to support them. The specifications in this annex define the requirements for interoperable implementations of these legacy features.

These features are not considered part of the core ECMAScript language. Programmers should not use or assume the existence of these features and behaviours when writing new ECMAScript code. ECMAScript implementations are discouraged from implementing these features unless the implementation is part of a web browser or is required to run the same legacy ECMAScript code that web browsers encounter.

effectively deprecating their usage.