GitHub leaves malicious imitation software up for weeks
The gist
A developer reported a fake Easy Data Transform repo to GitHub on Aug 31.
GitHub's slow takedowns matter to anyone downloading software.
How it unfolded
- Aug 31, 2026A customer emailed the Easy Data Transform developer that an imitation using the product name and logo without permission had been found on GitHub; the developer reported it to GitHub as an imitation the same day.
- Sep 10, 2026The developer reported additional information to GitHub after a colleague scanned the Mac .dmg from the repository on virustotal.com and got many malware warnings, and used Isobuster to find the .dmg background image had been changed to encourage downloaders to ignore malware warnings.
- Sep 16, 2026Stolen source code appeared on a cybercrime forum, revealing the May 22 theft of about 170 private GitHub repositories from CrowdSec after a former employee's account was compromised through May's TanStack npm supply chain attack.