GitHub took down a malware-laced imitation of Easy Data Transform on Sept. 24, more than three weeks after the data-wrangling tool’s developer, Andrew Rollings, first reported it. By his account, it came down about 10 minutes after his complaint reached the front page of Hacker News.
Rollings wrote on his blog, Successful Software, that a customer emailed him on Aug. 31 about a GitHub repository using his product’s name and logo without permission. He reported it to GitHub as an imitation the same day and got an automated reply. A colleague then scanned the repository’s Mac .dmg file on VirusTotal and got “a whole load of malware warnings,” and found that its background image had been changed to tell downloaders to ignore those warnings. Rollings sent GitHub that information on Sept. 10. As of Sept. 23 he had heard nothing beyond the original automated email. “This is pisspoor,” he wrote. “Do better Github.”
He said the people most likely to download the fake were those trying to avoid paying for a license, and that he didn’t have much sympathy for them. “But I really don’t like bad guys taking advantage of my hard work,” he wrote. In an update to the post after the takedown, he added: “If you want even the most basic level of support from Github, you need to get on the front page of Hacker News.” One commenter on his post said a fake page of their product, reported in June, came down a few hours after they followed up with a DMCA request and then a trademark violation report.
A pattern of cloned repositories
Fake repositories have been a recurring problem on GitHub this year. In June, a developer who blogs as Orchid reported finding about 10,000 repositories that cloned legitimate projects, kept their commit history and contributors, and added a README link to a ZIP file carrying a Trojan, Gigazine reported. He found them by filtering push events from roughly 16 million commits in GH Archive, and said GitHub had begun deleting the repositories his script flagged. A VirusTotal scan of only the link came back clean, he said, while a scan of the ZIP itself found the Trojan.
Security firm Hexastrike had reported 109 such repositories in April, and Tech Times said Orchid’s count put the campaign at roughly 91 times that, with some repositories active for more than a year. The malware chain starts with a LuaJIT-based loader that Hexastrike calls SmartLoader and can end with the StealC infostealer. Tech Times also cited Deep Specter Research, which documented that GitHub rejected two reports about the commit-display design these clones exploit, classifying them as non-security issues.
In July, researchers at Island described a related operation they call FakeGit, with about 7,600 malicious repositories pushing SmartLoader and StealC, BleepingComputer reported. More than 800 posed as AI skills or MCP servers and appeared more than 600 times in public AI registries, a tactic Island calls AgentBaiting. In Island’s tests, ChatGPT, Gemini and Claude surfaced some of the malicious repositories. Download counters on a subset recorded 14,084,688 events, though Island said that figure includes repeated and automated requests and shouldn’t be read as infections.
Days earlier, Arctic Wolf said a financially motivated actor had published at least 292 brand-impersonation GitHub pages and repositories since June 26, including one posing as Arctic Wolf. Concealed links routed visitors through github.io redirectors to a fake download page serving a ZIP that regenerated about every 60 seconds. Inside, a renamed, legitimately signed WinGUP updater side-loaded a trojanized libcurl.dll that ran a BoryptGrab-lineage infostealer in memory. When Arctic Wolf enumerated the 292 repositories, GitHub had already removed a substantial portion, and 78 were still active.
In September, LastPass and Delphos Labs detailed a campaign that used search-optimized fake GitHub organizations to impersonate at least 40 companies, including LastPass Authenticator, International Business Times reported. Victims saw fake “VirusTotal Approved” badges and downloaded ZIP files as large as 148MB, a size the researchers said was meant to slip past scanners with file-size limits. A signed driver in the chain terminated any of 145 named security products before the Rapuncel stealer collected data.
Rollings’ own advice was shorter: “Always download software from the vendor, where possible.”
WebProNews is an iEntry Publication