Malus.sh Sells “License Liberation” — AI Robots Clone Your npm Packages in International Waters
Malus.sh Sells “License Liberation” — AI Robots Clone Your npm Packages in International WatersA satirical “Clean Room as a Service” just exposed the exact thing Big Tech is already doing with LLMs — and devs are NOT laughing
A fake startup called Malus (“evil” in Latin) launched a site promising to strip open source attribution using AI robots. HN commenters couldn’t tell it was satire. Because it isn’t, really.
The site — complete with Stripe checkout, per-KB pricing, and a “MalusCorp-0 License” — promises to recreate any npm package “from scratch” so you never have to credit a single maintainer again. The punchline? Companies with billion-dollar AI models are doing exactly this. Right now. For real.
🧩 Dumb Mode Dictionary
| Term | Translation |
|---|---|
| Clean Room | Legal strategy where devs recreate software without seeing the original code, so it’s not a “copy” |
| AGPL | The open source license that forces you to share YOUR code if you use theirs — corporate nightmare fuel |
| Copyleft | License that says “if you modify this, your version must also be open source” |
| MC-0 Pass | Malus’s fake certification that your AI-cloned code is “legally distinct” |
| Attribution | The part of most licenses that says “hey, at least put our name somewhere” |
| npm Manifest | The file (package.json) listing every open source package your app depends on |
📖 The Backstory — What Even Is This
Okay so. You know how every couple months some startup does something so cartoonishly evil that you assume it’s a joke? Yeah.
Malus.sh appeared on Hacker News looking like a perfectly legit SaaS product. Upload your package.json. Their “proprietary AI robots” — operating in “international waters” apparently — recreate every dependency from scratch. Out comes code under the MalusCorp-0 License. Zero attribution. Zero copyleft. Zero giving credit to the people who wrote the thing you’re shipping.
The company name literally means “evil” in Latin. The testimonial is from “Chad Stockholder, Profit First LLC.” The audit logs “definitely exist and are available upon request to courts in select jurisdictions.”
It’s satire. Obviously. Except…
😤 Why Nobody Could Tell It Was a Joke
Here’s the uncomfortable part. Multiple HN commenters read the whole site and went “wait, is this real?” One person literally wrote:
“The fact that it took me the comments section to understand this is satire speaks a lot about the current status of where things are going.”
And they’re right? Because:
- LLMs trained on open source code already generate “functionally equivalent” implementations daily
- GitHub Copilot has been doing a version of this since 2021
- Companies ARE using AI to avoid dependency on copyleft libraries
- The economic incentive is massive — why maintain 200 OSS dependencies when you can just… regenerate them?
The satire works because it describes a thing that is literally already happening. Just without the honest branding.
📊 The Malus Feature Sheet (100% Fake, 100% Plausible)
| Feature | What They Claim |
|---|---|
| Input | Your package.json, requirements.txt, etc. |
| Process | AI “robots” analyze only public docs and APIs |
| Output | Functionally equivalent code, new license |
| Pricing | Per-KB of unpacked package size |
| License | MalusCorp-0 (their own — zero obligations) |
| Targets | MIT, Apache-2.0, AGPL, GPL, LGPL, BSD, MPL |
| Legal shield | “Offshore subsidiary” indemnification |
| Max package | 50 packages, 10 MB each unpacked |
🗣️ What Devs Are Actually Saying
The HN thread is a goldmine of existential dread disguised as tech commentary:
- “It wouldn’t be funny if it wasn’t close to the truth” — the most upvoted take
- Multiple devs pointed to the chardet library controversy where maintainers were pressured by corporations as proof this energy already exists
- Some argued clean room reimplementation via AI is technically legal under current copyright law — the same way Google’s clean room Java implementation survived the Oracle lawsuit
- Others flagged that if this DID become a real service, the AGPL would be the first casualty — the one license specifically designed to prevent this exact scenario
The vibe is: “haha this is so funny” followed immediately by “wait no this is terrifying”
⚙️ The Real Threat Under the Joke
Strip away the satire and here’s what’s left:
- AI code generation is already a de facto clean room. The model “never saw” your specific code. It just saw… all code. On earth. Including yours.
- License compliance is about to get way harder. If AI can generate code that’s functionally identical but technically “original,” what does copyright even mean?
- Open source maintainers are already burned out. Now add “your work can be AI-laundered in seconds” to the pile.
- Corporate legal teams are watching. If someone CAN build this for real (and they can), someone WILL.
The Malus creator basically said the quiet part loud. With a Stripe button.
Cool. AI Can Launder Open Source Now. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
🛡️ Build an OSS License Compliance Audit Tool
Most companies have NO idea what licenses live in their dependency tree. Build a CLI or SaaS tool that scans package.json / requirements.txt / Cargo.toml and flags AGPL, GPL, and copyleft risks before they ship. Pair it with AI to auto-suggest compliant alternatives.
Example: A solo dev in Tallinn, Estonia built an open-source license scanner called DepAudit after seeing his employer accidentally ship AGPL code. Posted it on r/SideProject, got 2,000 GitHub stars in a week, then sold a “Pro tier” with Slack alerts for $3,200/mo within 6 months.
Timeline: 2-4 weeks for MVP, monetize via SaaS tier for teams
📝 Create a 'Maintainer Attribution' Verification API
There’s going to be a market for PROVING that code was human-written and properly attributed. Build an API that takes a code snippet, cross-references it against known OSS repos, and returns a confidence score for originality vs. AI-laundered output.
Example: A two-person team in Pune, India built a plagiarism-detection API for academic code after their professor couldn’t tell student submissions from Copilot output. Pivoted to commercial use when a compliance firm reached out. Now processing 40,000 API calls/day at $0.002/call.
💰 Launch an 'Ethical Dependency' Badge System
Companies love badges. “SOC-2 Compliant.” “Carbon Neutral.” Build a verification system that certifies a project uses ONLY properly licensed dependencies with full attribution. Charge companies for the audit, give them a badge for their README and marketing.
Example: A freelance compliance consultant in Berlin, Germany started manually auditing npm dependency trees for fintech startups after one client got flagged in a due diligence review. Automated it with a script, branded it CleanStack Certified, and now charges €800/audit with 15 recurring clients.
🔧 Build a 'License Poison Pill' for OSS Maintainers
If AI can strip attribution, maintainers need new weapons. Build a tool that embeds cryptographic watermarks or stylometric fingerprints into open source code — something that survives AI reimplementation and can prove derivation in court.
Example: A security researcher in São Paulo, Brazil built a proof-of-concept code watermarking tool for her thesis, posted it on GitHub, and got featured on Hacker News. A legal tech firm licensed the approach for $25,000 upfront + royalties to integrate into their IP protection suite.
🛠️ Follow-Up Actions
| Step | Action |
|---|---|
| 1 | Audit YOUR project’s dependency licenses today — run npx license-checker |
| 2 | Read the AGPL and understand what “network use” means for your SaaS |
| 3 | Follow the Software Freedom Conservancy for legal updates on AI + OSS |
| 4 | If you maintain OSS: add a clear LICENSE file AND a NOTICE file with attribution requirements |
| 5 | Join the conversation on HN thread — the discourse is genuinely important |
Quick Hits
| Want | Do |
|---|---|
 Check your licenses |
Run npx license-checker --summary in your project root |
 Understand clean room law |
Read the Oracle v. Google ruling — it’s the precedent |
 Protect your OSS project |
Add AGPL-3.0 if you want maximum copyleft protection |
 See the satire yourself |
Visit malus.sh and count how long before you question reality |
 Join the debate |
HN Discussion — 200+ comments of devs processing grief |
The funniest part about Malus isn’t that someone built it as a joke. It’s that three VCs probably emailed the founder asking for a demo.
!