8 ms·
I found 10k GitHub repositories distributing Trojan malware
- deleted 4mo ago[deleted]
- astronodev 4mo agoI uploaded several of these virus-infected archives to VirusTotal. In each archive, under the “Network Communication” section, the virus makes requests to three resources: a GET request to a website to retrieve IP information, a POST request to a Polygon RPC node (drpc), and a POST request to what appears to be the virus creator’s server. I can only assume that the scheme is designed to steal cryptocurrency.
- axus 4mo agoIt will feel very spooky when they stop updating because of this essay .
- mmsc 4mo ago> Another month later, GitHub support sent me an email saying that they had removed these repositories. I recently discovered a campaign where somebody was forking very small but useful codebases, and replacing the distributable with some malware, and making the repository have better SEO with changes to the README. My case was a simple macOS application that could be used to control some Phillips LED light strip. I reported it to GitHub and it was removed within 24 hours. I discovered another repository like this, and they still haven't replied since (one month). No clue how their malware reports work. I'm surprised they don't partner with some antivirus company to at least scan "releases" for malware (not repositories themselves)
- mrbluecoat 4mo ago> I'm surprised they don't partner with some antivirus company to at least scan "releases" for malware ...like Windows Defender? Oh, the irony :D
- lookeey 4mo agoIt happened a few times to me that I'd find some very well constructed scam scheme (cryptocurrency washing systems, web platform/phishing scams), then I'd research deeper into it to see how it worked, just to ultimately feel powerless not knowing what to do with the information.
- dentemple 4mo agoThis is what a community is for! No individual person can be the superhero that saves the day on everyone's behalf. But what we can do is provide what little help or insight that we have, and then pass the issue along to others. Perhaps all it means is that you end up doing what OP did: the "deeper" research that you mentioned plus a little post on Hacker News or elsewhere. Even if nothing comes of it in the end, at least you'll have tried.
- RetroTechie 4mo agoIt's a matter of how much effort you want to put in, and what you get out of it. Years ago, a friend of mine fell victim to a romance scam. Damage ~€3k. It involved fake websites of non-existing logistics companies, a fake banking site where victim could 'help' a person 'transfer funds' for them, a long chat history (over Viber or something like that, initiated through Facebook), etc. This being a good friend, I put in some legwork, saved local copies of sites, etc. Some findings: # It's easy to find copies of sites of the one(s) used to defraud victim. In this case, ~50. And compile a list, what's the hoster of each & where domains are registered. # Fake banking sites are easy to determine since legitimate banks are recorded in per-country registries. Legitimate: website's security certificate (extended validation etc) indicates [bank_X], bank_X listed as such in registry of country it operates in. Not? -> fake. For non-banking fake sites it's more difficult to tell. # Hosting companies & domain registrars do take action. As long as you provide correct & detailed info, in such a way that it's easy for them to act on. Professional companies don't like having legal / financial liabilities sit around. # If there's security certificates involved, informing issuer of that can remove "secure connection" from a whole batch of sites in 1 go. Makes it harder to convince future victims. (no lock icon on a banking site?!?) # An official request could be filed with this victim's bank (passed on to recipient's bank), that would give holder of recipient account 2 options: a) return the funds, or b) have their personal details revealed to victim - for use in legal proceedings etc. This was within EU area. Likely, recipient would be a money mule & not respond. But then you'd get money mule's full name/contact info etc (home address?) # Police / fraud orgs etc rarely have time for this. You need to do the legwork yourself. Ultimately, my friend decided not to pursue the matter. But in the mean time, I had caused >2/3 of those fake sites to be deleted (and all the fake banking sites I'd found), and some security certificates to be revoked. Obviously that disrupts scammer's operations to some degree (and costs them time, $$, potential victims dropped etc). So it's not like you can't do anything.
- jp0001 4mo agoI uploaded a sample found here (https://github.com/alexct142010-cell/McBackuper https://github.com/alexct142010-cell/McBackuper ) to Genus Codes (need an account): https://genuscodes.com/results/7ad4b911d05a12f91ab27ba3baa351a56653ca099dda7ad87ee2b94f8cd018c9 https://genuscodes.com/results/7ad4b911d05a12f91ab27ba3baa35... Seems to be related to the disco trojan family, by way of normalized function matching at 50% to malicious file https://genuscodes.com/results/eddbc29db4677e00c1a901aadbadb6fa32475fffe034a106aa7aead997e39469 https://genuscodes.com/results/eddbc29db4677e00c1a901aadbadb... and a normalized 50% match to https://genuscodes.com/results/fdb6cff68a2a8c08779d64a7cf61d3d6d676e0ed8e217ae010127600de018437 https://genuscodes.com/results/fdb6cff68a2a8c08779d64a7cf61d... Virustotal link: https://www.virustotal.com/gui/file/fdb6cff68a2a8c08779d64a7cf61d3d6d676e0ed8e217ae010127600de018437 https://www.virustotal.com/gui/file/fdb6cff68a2a8c08779d64a7...
- emodendroket 4mo agoI have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.
- embedding-shape 4mo ago> the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons You've been living on such a principle? That sounds insane, why would something not be nefarious just because you can read the code? The way I was "raised" by FOSS greybeards screaming at me through web forums, was that any software available on 3rd party websites anyone can upload anything to, will be filled with viruses and malware, and this was early 2000s. Surely people still advocate for this mindset today, when it's even more likely?
- emodendroket 4mo agoNo, I've not been "living on" such a principle but it was a big claim for "the bazaar."
- embedding-shape 4mo agoAha, wasn't that argument more about that closed source software is more likely to hide stuff you don't agree with, than FOSS? Not necessarily that FOSS won't have any viruses or malware, but it's at least less likely. That was my take away, but long time ago I read the book admittedly, I might misremember or transformed it automagically over time.
- CapsAdmin 4mo agoThis is my takeaway as well. Having the source code open makes it auditable, if not by you, maybe the community. The free software license specifically gives the software an extra advantage in that changes to the software must be shared openly, if distributed as as binaries.
- fastcrw 4mo agoare there any ci/cd that controls them?
- astronodev 4mo ago[dead]
- rkozik1989 4mo agoPeople need to do their due diligence when including open-source software and packages not just when they first use them but anytime you have a need to upgrade them. I highly doubt I'm the first one to think of this, but there really aught to be tool or comprehensive set of tools that routinely scan open-source software and packages for potentially malicious code and alert users of the problem(s).
- cyber-anderson 4mo ago[dead]
- StableAlkyne 4mo ago> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The page was a near perfect copy, and I would easily have gotten pwnd by it if they didn't have a modal asking me to run some code in my terminal for "security activation" that made me go "that's a little odd... Is this the right address OH SHIT that's a .ru domain" I never see Google return phishing pages or typo squatters in the first page. Bing constantly returns that stuff in the first several results.
- weird-eye-issue 4mo agoThis is where password managers are useful because they would refuse to fill in login information since the domain doesn't match
- vel0city 4mo ago"Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..." Meanwhile U2F/Passkeys can't possibly be abused like this.
- tjoff 4mo agoYeah but the downsides of passkeys make them so much worse anyway.
- jcattle 4mo agoPretty happy with having a yubikey on my keychain. Log in someplace new? plonk in your yubikey and off you go!
- someguyiguess 4mo ago
- pydry 4mo agoMicrosoft: and the one thing we absolutely refuse to use AI for is to flag this kind of bullshit to protect users, because it would violate the rule of "don't do anything actually useful with it".
- radicaldreamer 4mo agoYou can bet they’ve tried it and had a bunch of false positives, so the PM nixed it because it would be bad for business.
- schedpilot 4mo agodamn 10k ? thats a lot, how did you get them ?
- theorchid 4mo agoHmm. Using a script. That's explained in the article)
- siva7 4mo agoHi Claude fable, why u not protecting me from malware? Am i not american enough? Not rich enough? Yieks..
- RoadieRoller 4mo ago> Why do they delete a commit and push a new one every few hours? May be to make it appear on the top of the "Last Updated" repositories in case someone searches for the repo or a keyword. So instead of the author's actual repo, the users endup cloning the trojan infected one.
- philistine 4mo agoBingo!
- mattgreenrocks 4mo agoThey're also gaming the heuristic that if an OSS repo hasn't had any pushes in ~6mos many users consider it defunct.
- biinjo 4mo ago‘Actively maintained’
- gus_ 4mo agoA year ago a similar attack was reported and I think that there have been similar campaigns reported this year: https://github.com/evilsocket/opensnitch/discussions/1290#discussioncomment-12727457 https://github.com/evilsocket/opensnitch/discussions/1290#di... - This is a new repository, not a fork - All repositories have different contributors and different names From the last two points, it becomes clear that even if we find one such repository, we won’t be able to find other similar repositories using it. In previous campaigns the repositories were linked to a few users. But those users had starred other users, that at the same time had also cloned other repositories with the malware. Sometimes the malicious repository had been cloned from another malicious repo, and if you listed the repositories and "friends" of that user, all were part of the botnet. Also, github doesn't delete repositories and accounts, they mark them as deleted. If you use their api you can still list them.
- Teknomadix 4mo ago>The zip archive contains 4 files: Application.cmd or Launcher.cmd loader.exe or luajit.exe or another_name.exe random_name.cso or random_name.txt lua51.dll If you submit a link to the archive to VirusTotal, it will find 0 viruses. If you submit the zip file itself, it will detect a Trojan inside it. MS Windows
- jslakro 4mo agoAny open source tool to scan a github repo before download/install it locally? I'm thinking of semgrep or socket.dev but I wonder if there's a better option
- downrightmike 4mo agoVirus total should be scanning GIthub at the least, because it is a job MS Defender can't appear to itself.
- GL26 4mo agois it possible to ban them or report them ?
- rambojohnson 4mo agothe en-ghettofication of american tech, down to its very open source control projects. a digital ghetto ill maintained if at all.
- doug_durham 4mo agoThere’s nothing new here. This is how open source software has been since its inception. It’s just the nature of reality.
- prmoustache 4mo agoThis story is totally unrelated to open-source. There is no mention of a source let alone a license.
- beej71 4mo agoI added keyoxide proofs everywhere. It's not really protection against victims using the wrong repo, but at least people who look can be certain that the person who controls my domain and website is the same person who controls that particular GitHub account.
- danso 4mo agoBeing reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually, after running another anti-virus program, he found a piece of malware hidden in a plug-in he had downloaded from GitHub, the open-source coding site, one day in February when he was messing around with an AI image generator. He had checked the code himself, it had looked legitimate, and others had reviewed it positively. But it seems it contained a Trojan-horse virus that gave the hackers free rein of his PC. Once inside, they just had to wait for Van Andel to log in to 1Password. From there, they were able to steal all his credentials, plus many of his multifactor-authentication codes, so every time Van Andel logged in to an app, a website, or an account, they could follow behind him. They’d had access for months. [0] https://www.wsj.com/tech/cybersecurity/disney-employee-ai-tool-hacker-cyberattack-3700c931 https://www.wsj.com/tech/cybersecurity/disney-employee-ai-to...
- tedd4u 4mo agoStrong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.
- Terr_ 4mo ago> putting your TOTP/MFA in your password manager I suppose the inverse would be starting with a device that offers TOTP/MFA, and then making your password-manager/vault somehow available on that same device. In either case, bringing them together makes it easier for an attacker to compromise both at the same time. On reflection, I've never actually put my (personal) password vault on my phone, but that may be less of a conscious security stance than fulfilling a millennial stereotype, where certain tasks (like big purchases) are reserved for "a real computer." Closest I've gotten is having my USB backup keychain in the same pocket, so I could get to it in an emergency, but it's inconveniently air-gapped.
- tgtweak 4mo agoThis is a failure of malware flagging systems as well - VT should not return clean if there are any downstream files that are malicious - such as in this case.
- bananamogul 4mo agoI reported a repo containing obvious nulled software to GitHub in February 2024. The title is "nulled WHMCS" and it's a full copy of that software with copy protection removed. It couldn't be more cut and dried. The repo is still there 2+ years later and GitHub has taken no action. If GitHub can't respond to tickets pointing out obvious pirated software, I don't think they care about anything anyone puts up.
- xantronix 4mo agoGitHub is so close to becoming SourceForge. In order to become the scum-infested cesspool it truly longs to be, Microsoft needs to relentlessly serve ads on GitHub. Then, the cycle will once again be complete. I can't wait to discover the next thing to be disappointed by in a decade's time.
- ForOldHack 4mo agoNice quote of Darth Vader there ;) "The cycle will once again be complete." Also reminds me to update my fake CV.
- lukan 4mo agoFor it to be complete, they need to start changing binaries and bundling software with a microsoft launcher.
- guhcampos 4mo ago> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents everywhere. 2. MAJOR elections happening this year in the World, including US midterms and Brazilian mains. This appears to be an account-stealer worm - and my guess is it's looking to all those sweet sweet Facebook/Instagram/Tiktok/Whatsapp accounts ready to bot their way into oblivion.
- vintermann 4mo agoPolitical manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.
- nine_k 4mo agoI suspect that politicians right before elections may pay more than standard gambling. They gamble with much higher stakes.
- netsharc 4mo agoHah, outsourcing political "influencing" to tiny "consulting" companies that promise great things but is a rickety AI slop shop in the backend. I suppose the only difference to the Big 4 is the price tag. I guess politicians could claim to be hiring a voter research company and profess to be oblivious to the "voter hacking" schemes (hacking the voters' minds to lean whichever way the politician wants them to lean).
- tommica 4mo agoOn that level, power and control trumps profit
- makethembroke 4mo agoa kind of
- ttoinou 4mo agoI got some source code leaked and added a malware on top of it. Not sure what to do with it
- mustaphah 4mo agoThis is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: - Made by a fresh GitHub user - many created in the past few days. - The average creation date of Stargazers accounts is very close to the repo creation date. If you take the mean time diff, those bad repos get exposed. I reported 10s of malware repos, but then I gave up as I felt GitHub was not really doing enough to fight back. I was like... these guys don't seem to care, why should I? God knows how many people have been abused by these malware repos on GitHub. --- [1] https://github.com/mhadidg/gh-trends https://github.com/mhadidg/gh-trends
- socalgal2 4mo agoMost of HN doesn't give a shit about the malware problem. They will happily click "Give XYZ App ... permission to act on your behalf" to all of their repos with zero knowledge of what permissions are being requested. Github's Auth system doesn't tell the user what permissions are being requested Note: Github has 2 auth systems. OAuth, and Github Auth. OAuth lists permissions but most apps use Github Auth which does not. So that app that gives you a badge or lets you comment could asking for write permission all your repos. You have no idea.
- sieabahlpark 4mo ago[dead]
- rozab 4mo agoIf most malware repos are created in the last few days by a fresh user, then it sounds like GitHub is taking action against them? Or where are the old ones?
- mustaphah 4mo agoWell, my trend detection logic rewards recent stars more than older ones [1]. Recency is an important factor for many custom and public tools that track GitHub trends. I think the bad guys intentionally recreate repos - I actually noticed that. That being said, they do take action if you report the repo. So I'm guessing good users are doing the heavy lifting here with reporting. I don't believe GitHub is taking enough proactive measures, or maybe they do, but it's not working well, obviously. https://hadid.dev/posts/github-trends/#growth-based-approach https://hadid.dev/posts/github-trends/#growth-based-approach
- factorymoo 4mo agoCan anyone tell me if there are similar risks installing software using Brew on macos? I would imagine so.
- Jimmc414 4mo agoThis is happening to me as well. I have a few moderately popular open source projects and I have found my name attached to new projects that I have nothing to do with or they are derivatives of my projects with redirection to unknown sites. Legitimate projects: https://github.com/jimmc414/onefilellm https://github.com/jimmc414/onefilellm https://github.com/jimmc414/Kosmos https://github.com/jimmc414/Kosmos https://github.com/jimmc414/cctrace https://github.com/jimmc414/cctrace Projects using my name which I have no affiliation with or they are projects I have written that they have injected new URLs into: https://hub.decision.ai/skills/jimmc414/benchling-integration https://hub.decision.ai/skills/jimmc414/benchling-integratio... https://lobehub.com/skills/jimmc414-claude-code-plugin-marketplace-local-llm https://lobehub.com/skills/jimmc414-claude-code-plugin-marke... https://mcpmarket.com/tools/skills/geniml-genomic-machine-learning https://mcpmarket.com/tools/skills/geniml-genomic-machine-le... https://mcpmarket.com/tools/skills/biopython-for-molecular-biology https://mcpmarket.com/tools/skills/biopython-for-molecular-b...
- schrodinger 4mo agoIdk if this is intentional or just part of an innocent site that’s unwittingly hosting these but I just got a “we’re verifying your browser” page, as if _I’m_ the suspicious one. Nice social engineering.
- SoftTalker 4mo agoHappens more and more if you're running uBlock.
- functionmouse 4mo agoMicrosoft bought it a while ago. What you're seeing is referred to as "Extinguish".
- 0l 4mo agoMicrosoft bought Vercel???
- lelanthran 4mo ago
- davidcrowe 4mo agoSame thing happened to one of my repos in Feb. I wrote up the details with screenshots. https://reducibl.com/writing/someone-used-my-repo-to-distribute-malware https://reducibl.com/writing/someone-used-my-repo-to-distrib...
- dawnerd 4mo agoDid Github ever do anything?
- davidcrowe 4mo agoYea, they removed the fork <24 hours after I reported it
- theorchid 4mo agoThank you. I've added a link to your article in my article.
- KolmogorovComp 4mo agoThanks for the writing, which would have been even better had it been written by a human.
- theorchid 4mo agoWhy do you think it wasn't written by a human?
- KolmogorovComp 4mo agoHave you read the article? > that’s not a developer contributing to open source. that’s someone manufacturing the appearance of activity. > the attacker’s own profile? no bio, no avatar, 499 contributions crammed into january–february 2026. > this wasn’t random > i reported the repo to github. the ticket is open. but this raises a question i keep coming back to
- 4mo ago
- excalibur 4mo agoYou guys, I think maybe THIS is the Bad Place.
- usman18 4mo ago[flagged]
- ForOldHack 4mo agoThis is what it is used for: https://dev.to/andersoncontreira/warning-to-developers-a-new-wave-of-technical-test-scams-is-targeting-devs-4ifh https://dev.to/andersoncontreira/warning-to-developers-a-new... A “recruiter” (sometimes pretending to be a CEO/HR) contacts you. The job looks amazing — above-market salary, remote position, paid in USD, etc. They ask for your CV and GitHub. They say you’re “approved for the next stage” without any real interview. Before the call, they send you a codebase to review or modify as a “technical test.” When I get one of these, I automatically spin up a cloned VM, and test it there, which for the most part it gets infected immediately. as I watch the VM connect to odd places ( C&C computers ) for which I add any names/IP addresses to my host file, and then spin up another cloned VM, with the adjustments to the hosts file, and watch the malware get all lonely... but once, it was able to escape the VM... so I had to scramble to disinfect both the RM and the VM, and then update, and look around for hardening tools. Its satisfying to delete an infected VM, with a "Not this time Jack."
- avodonosov 4mo agoSimilar case: https://news.ycombinator.com/item?id=43203158 https://news.ycombinator.com/item?id=43203158 https://timsh.org/github-scam-investigation-thousands-of-mods-and-cracks-stealing-your-data/ https://timsh.org/github-scam-investigation-thousands-of-mod...
- BLACKCRAB 4mo ago[dead]
- BLACKCRAB 4mo ago[dead]
- anujshashimal98 4mo agoThe scary part is how easily malicious repos can blend in with legitimate open-source projects
- codedokode 4mo ago> Why do they delete a commit and push a new one every few hours? Maybe they want to get into "trending" section, or to have higher position in search results (maybe Github or Google prioritizes repositories updated recently)?
- codedokode 4mo agoThis highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root issue. And Linux has no warning and no button to check the program with antivirus before running. How worse could it be? In comparison, on Android and iOS there are sandboxes, and you can run any program relatively safely as long as you don't grant dangerous permissions and your kernel is not outdated. And even if you grant permissions, the malware still won't be able to read your browser cookies or the messages in your Matrix client. Linux needs to be better that this. Linux seems to be built on presumption that you either download the code from official repository you trust, or write your own, and doesn't support safe execution of third-party or closed-source programs. For example, if you run proprietary software, it might scan through your data, silently collect your hardware identifiers (like motherboard serial number) to better track and identify you and Linux does not prevent this.
- mittensc 4mo agoYou can use VMs for sandboxes. Linux main feature is that you are free to do anything you want. Linux does verify signatures for packages from official repos. Linux has features like SELinux and AppArmor. If you want to install a random package, you are free to do and its your responsibility. Equivalent is side loading in android. On iOS Apple doesn't even let you have full Firefox... That is wrong. And yet, there have always been exploits.
- codedokode 4mo agoI thought about VM but it would be pretty expensive and require lot of RAM (which is not cheap nowadays and not always upgradeable on laptops. How would you upgrade your 8 Gb MacBook?) and CPU overhead to emulate the hardware and run one more kernel. The program in VM would not be able to use OpenGL/Vulkan, access the audio card with low latency (for working with audio), connect to DBus (to interact with other software). I actually ran Windows games like Cyberpunk in qemu on a Linux host without performance loss, but that required adding a dedicated GPU for guest and to use realtime audio, one needs to pass through an audio card into the guest. Furthermore, the CPU already provides a "sandbox" (isolated memory) for processes. The problem is that Linux allows the program to ask the kernel to do anything. > Linux has features like SELinux and AppArmor. Neither SELinux not AppArmor allows to show a question "would you like to allow program N to access your microphone" or "would you like to let the program connect to github.com? (Yes) (No) (With decrypting SSL traffic)". They look like they are made to comply with some outdated standards from 80s. The best you can do today is either write your own sandbox around Linux namespaces (very complicated), or try lightweight VMs like Firecracker, or paravirtualization (like VM but with a shared kernel). Those solutions are made for server use, not for desktop, and require lot of work and programming. > If you want to install a random package, you are free to do and its your responsibility. Equivalent is side loading in android. I want to install random packages and still be safe. That's the point of installing an OS, to be able to run random programs on the computer.
- mowfask 4mo agoAdding a link to a malware zip? That seems pretty naive. Where are all the training-data poisoning repositories? Those set up so the next generation LLMs will be trained to include malware in the code they generate. Isn't that the new kind of supply-chain attack that's probably happening right now?
- ma2kx 4mo agoIs this also a some kind of a Trojan/malware attack? https://news.ycombinator.com/item?id=48594733 https://news.ycombinator.com/item?id=48594733 https://pypi.org/project/prylint/ https://pypi.org/project/prylint/ > A Rust reimplementation of pylint that produces byte-for-byte identical output — 15–2300× faster (median ~85×). > prylint is not "inspired by" pylint. [...] Where pylint has bugs, prylint reproduces them. Where pylint crashes, prylint reports the same crash message.
- Omniloop 4mo ago[flagged]
- overloadedop 4mo agoI did a bit of reversing on it and it looks like it's a copy/fork of Aeternum. It takes screenshot and uploads it to a TA controlled infra, makes some eth_call via json rpc to polygon. the C2 is hosted by Organization: Standart AG, LLC (Latvia) ASN: AS207957
- overloadedop 4mo ago[dead]
- alper 4mo agoGithub should be treated as a toxic waste site. I don't see it ever being secured by Microsoft.
- jessinra98 4mo ago0 action. If GitHub can't respond to tickets pointing out obvious pirated software, I don't think they care about anything anyone puts up.
- vanyaland 4mo ago[flagged]
- f311a 4mo agoI reported 100 of them 4 months ago and they were not removed after 3 months. They just don’t care, no one answered the ticket.
- umairnadeem123 4mo ago[dead]
- deleted 4mo ago[deleted]
- wedesoft 4mo agoMaybe GPG-signing commits helps.
- AndorinaAI 4mo agoOMG, that's very serious and something to worry about...
- copyjosh 4mo ago[dead]