I found 10k GitHub repositories distributing Trojan malware

	I found 10k GitHub repositories distributing Trojan malware(orchidfiles.com)
	966 points by theorchid 46 days ago \| 246 comments
	tl;dr: A developer discovered ~10,000 GitHub repositories distributing Trojan malware by cloning legitimate new repos (preserving commits and contributors for credibility), then periodically force-pushing a README update with a link to a malicious zip archive. He wrote a script using GitHub event archives to identify them based on patterns like frequent "Update README.md" commits, and published the list. GitHub only removed repos explicitly reported, ignoring the underlying detection problem—meaning the script continues to find new ones, and the campaign (active for over a year) persists.
	HN Discussion: ↑The campaign targets AI coding agents rather than humans, explaining the unusual patterns ↑Personal confirmation of having their repos cloned and weaponized in similar attacks ↑GitHub systematically ignores abuse reports, confirming the article's criticism •Technical analysis linking the samples to known trojan malware families ↑Broader context about how malware from GitHub causes real-world harm to victims