Warning: Fake GitHub Repos Distributing Malware Under Developer Names

[u/segevs]

Hey everyone,

I’ve noticed a few posts about this already, but I think it’s worth repeating. Recently, a new attack tactic has surfaced where malicious actors create GitHub repos using a developer’s name and the name of a well-known Mac app.

In my case, someone created a repo under my full name, claiming to offer one of my apps (Dory - App Switcher) for free. I couldn’t fully investigate the script they shared, but it’s safe to assume it wasn’t anything good. Thankfully, GitHub removed it within 30 minutes of my report - and I know other developers also flagged the user, which definitely helped.

A few reminders:

* Don’t trust repos with fewer than 100 stars that offer “free” versions of paid apps.

* Never run scripts or pkg files from sources you don’t fully trust.

* If you’re not a power user, the App Store remains the safest option.

[u/MelbPTUser2024]

Is it safe to assume homebrew cask installs are safe and checked for malware?

[u/segevs → u/MelbPTUser2024]

Absolutely not.

[u/coffeeatmydesk]

This is a great reminder, and it's not just about the repos themselves either. I'm about to ship a small Mac utility outside the App Store and the trust gap for anything installed that way is real, so I've been leaning hard on notarization and being upfront about exactly what the app does and doesn't touch on someone's machine. Appreciate you posting this, more devs should be vocal about it when it happens to them instead of quietly reporting and moving on.

[u/Peaksign9445122]

Always run any executables you don’t fully trust through Virustotal. Make it a habit

[u/lzgip → u/Peaksign9445122]

Real and applies to ANY OS.

[u/Merlindru]

This is very interesting but don't rely on stars as an indicator for legitimacy. They can be bought, are relatively cheap, and especially so in the hundreds of stars

Thank you for documenting your experience

[u/JailbreakHat]

There has been a very similar incident on Arch Linux recently where attackers uploaded packages on AUR (Arch User Repository) that had malware hidden in the install script. These packages eventually taken down by Arch Linux security team following reports from users.

[u/macross1984]

I downloaded free converter software from GitHub. I didn't open it and as precaution I ran BitDefender to do system check and it came back as malware.

I deleted the offending software.

[u/lzgip]

Thank you. Thank you for the advice, really.

[u/Techniklover]

hm dont rely on github repos offering you software hm really ?!?!?!?! hmmmmmmm