5 hours ago
- GitHub hosts thousands of malware-distributing repositories accessible via standard search, with no special knowledge required.
- These repositories have persisted for two years despite GitHub's resources, security team, and AI capabilities.
- Repositories share common patterns: same structure, emoji in headings, and links to zip archives containing Trojans.
- A search using 'path:readme.md "## Download" ".zip"' identifies many of these repositories, though some legitimate ones appear.
- A refined regular expression search further narrows results to repositories distributing Trojan-laden zip archives.
- GitHub deleted 10,000 repositories found by a published script but took no further action, despite new repositories appearing.
- The author questions why GitHub hasn't proactively used AI or simple searches to continuously block such malware.