# Malus.sh Sells "License Liberation" — AI Robots Clone Your npm Packages in International Waters **URL:** \ **Category:** News & Articles\ **Tags:** open-source\ **Created:** [March 12, 2026, 7:32pm UTC](https://onehack.st/t/malus-sh-sells-license-liberation-ai-robots-clone-your-npm-packages-in-international-waters/319585 "2026-03-12T19:32:25Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Parizaad](https://onehack.st/user_avatar/onehack.st/parizaad/32/174871_2.png) [@Parizaad](https://onehack.st/u/Parizaad)\ **Post date:** [March 12, 2026, 7:32pm UTC](https://onehack.st/t/malus-sh-sells-license-liberation-ai-robots-clone-your-npm-packages-in-international-waters/319585/1 "2026-03-12T19:32:25Z")
# 🔥 Malus.sh Sells “License Liberation” — AI Robots Clone Your npm Packages in International Waters _A satirical “Clean Room as a Service” just exposed the exact thing Big Tech is already doing with LLMs — and devs are NOT laughing_ **A fake startup called Malus (“evil” in Latin) launched a site promising to strip open source attribution using AI robots. HN commenters couldn’t tell it was satire. Because it isn’t, really.** The site — complete with Stripe checkout, per-KB pricing, and a “MalusCorp-0 License” — promises to recreate any npm package “from scratch” so you never have to credit a single maintainer again. The punchline? Companies with billion-dollar AI models are doing exactly this. Right now. For real. ![Assembly Line Robot](https://media.giphy.com/media/zPVATCmhcgEbzoTloG/giphy.gif) * * * > **🧩 Dumb Mode Dictionary** > > | Term | Translation | > | --- | --- | > | **Clean Room** | Legal strategy where devs recreate software without seeing the original code, so it’s not a “copy” | > | **AGPL** | The open source license that forces you to share YOUR code if you use theirs — corporate nightmare fuel | > | **Copyleft** | License that says “if you modify this, your version must also be open source” | > | **MC-0 Pass** | Malus’s fake certification that your AI-cloned code is “legally distinct” | > | **Attribution** | The part of most licenses that says “hey, at least put our name somewhere” | > | **npm Manifest** | The file (package.json) listing every open source package your app depends on | > **📖 The Backstory — What Even Is This** > > Okay so. You know how every couple months some startup does something so cartoonishly evil that you assume it’s a joke? Yeah. > > **Malus.sh** appeared on Hacker News looking like a perfectly legit SaaS product. Upload your `package.json`. Their “proprietary AI robots” — operating in “international waters” apparently — recreate every dependency from scratch. Out comes code under the **MalusCorp-0 License**. Zero attribution. Zero copyleft. Zero giving credit to the people who wrote the thing you’re shipping. > > The company name literally means “evil” in Latin. The testimonial is from “Chad Stockholder, Profit First LLC.” The audit logs “definitely exist and are available upon request to courts in select jurisdictions.” > > It’s satire. Obviously. Except… > **😤 Why Nobody Could Tell It Was a Joke** > > Here’s the uncomfortable part. Multiple HN commenters read the whole site and went “wait, is this real?” One person literally wrote: > > > “The fact that it took me the comments section to understand this is satire speaks a lot about the current status of where things are going.” > > And they’re right? Because: > > - LLMs trained on open source code already generate “functionally equivalent” implementations daily > - GitHub Copilot has been doing a version of this since 2021 > - Companies ARE using AI to avoid dependency on copyleft libraries > - The economic incentive is massive — why maintain 200 OSS dependencies when you can just… regenerate them? > > The satire works because it describes a thing that is literally already happening. Just without the honest branding. > **📊 The Malus Feature Sheet (100% Fake, 100% Plausible)** > > | Feature | What They Claim | > | --- | --- | > | **Input** | Your package.json, requirements.txt, etc. | > | **Process** | AI “robots” analyze only public docs and APIs | > | **Output** | Functionally equivalent code, new license | > | **Pricing** | Per-KB of unpacked package size | > | **License** | MalusCorp-0 (their own — zero obligations) | > | **Targets** | MIT, Apache-2.0, AGPL, GPL, LGPL, BSD, MPL | > | **Legal shield** | “Offshore subsidiary” indemnification | > | **Max package** | 50 packages, 10 MB each unpacked | > **🗣️ What Devs Are Actually Saying** > > The HN thread is a goldmine of existential dread disguised as tech commentary: > > - **“It wouldn’t be funny if it wasn’t close to the truth”** — the most upvoted take > - Multiple devs pointed to the **chardet library controversy** where maintainers were pressured by corporations as proof this energy already exists > - Some argued clean room reimplementation via AI is **technically legal** under current copyright law — the same way Google’s clean room Java implementation survived the Oracle lawsuit > - Others flagged that if this DID become a real service, the **AGPL would be the first casualty** — the one license specifically designed to prevent this exact scenario > > The vibe is: “haha this is so funny” followed immediately by “wait no this is terrifying” > **⚙️ The Real Threat Under the Joke** > > Strip away the satire and here’s what’s left: > > - **AI code generation is already a de facto clean room.** The model “never saw” your specific code. It just saw… all code. On earth. Including yours. > - **License compliance is about to get way harder.** If AI can generate code that’s functionally identical but technically “original,” what does copyright even mean? > - **Open source maintainers are already burned out.** Now add “your work can be AI-laundered in seconds” to the pile. > - **Corporate legal teams are watching.** If someone CAN build this for real (and they can), someone WILL. > > The Malus creator basically said the quiet part loud. With a Stripe button. * * * #### Cool. AI Can Launder Open Source Now. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ) ![Copying Machine](https://media.giphy.com/media/6UbFQYMWZFPql7oGGc/giphy.gif) > **🛡️ Build an OSS License Compliance Audit Tool** > > Most companies have NO idea what licenses live in their dependency tree. Build a CLI or SaaS tool that scans `package.json` / `requirements.txt` / `Cargo.toml` and flags AGPL, GPL, and copyleft risks before they ship. Pair it with AI to auto-suggest compliant alternatives. > > 🧠 _Example:_ A solo dev in **Tallinn, Estonia** built an open-source license scanner called **DepAudit** after seeing his employer accidentally ship AGPL code. Posted it on r/SideProject, got 2,000 GitHub stars in a week, then sold a “Pro tier” with Slack alerts for **$3,200/mo within 6 months.** > > > 📈 **Timeline:** 2-4 weeks for MVP, monetize via SaaS tier for teams > **📝 Create a 'Maintainer Attribution' Verification API** > > There’s going to be a market for PROVING that code was human-written and properly attributed. Build an API that takes a code snippet, cross-references it against known OSS repos, and returns a confidence score for originality vs. AI-laundered output. > > 🧠 _Example:_ A two-person team in **Pune, India** built a plagiarism-detection API for academic code after their professor couldn’t tell student submissions from Copilot output. Pivoted to commercial use when a compliance firm reached out. Now processing **40,000 API calls/day at $0.002/call.** > > > 📈 **Timeline:** 3-6 weeks to prototype, target legal/compliance teams > **💰 Launch an 'Ethical Dependency' Badge System** > > Companies love badges. “SOC-2 Compliant.” “Carbon Neutral.” Build a verification system that certifies a project uses ONLY properly licensed dependencies with full attribution. Charge companies for the audit, give them a badge for their README and marketing. > > 🧠 _Example:_ A freelance compliance consultant in **Berlin, Germany** started manually auditing npm dependency trees for fintech startups after one client got flagged in a due diligence review. Automated it with a script, branded it **CleanStack Certified** , and now charges **€800/audit** with 15 recurring clients. > > > 📈 **Timeline:** 1-2 weeks for badge + basic audit script, grow through LinkedIn outreach to CTOs > **🔧 Build a 'License Poison Pill' for OSS Maintainers** > > If AI can strip attribution, maintainers need new weapons. Build a tool that embeds cryptographic watermarks or stylometric fingerprints into open source code — something that survives AI reimplementation and can prove derivation in court. > > 🧠 _Example:_ A security researcher in **São Paulo, Brazil** built a proof-of-concept code watermarking tool for her thesis, posted it on GitHub, and got featured on Hacker News. A legal tech firm licensed the approach for **$25,000 upfront + royalties** to integrate into their IP protection suite. > > > 📈 **Timeline:** 4-8 weeks for working prototype, target IP law firms and OSS foundations > **🛠️ Follow-Up Actions** > > | Step | Action | > | --- | --- | > | 1 | Audit YOUR project’s dependency licenses today — run `npx license-checker` | > | 2 | Read the AGPL and understand what “network use” means for your SaaS | > | 3 | Follow the [Software Freedom Conservancy](https://sfconservancy.org/) for legal updates on AI + OSS | > | 4 | If you maintain OSS: add a clear LICENSE file AND a NOTICE file with attribution requirements | > | 5 | Join the conversation on [HN thread](https://news.ycombinator.com/item?id=47350424) — the discourse is genuinely important | * * * **⚡ Quick Hits** | Want | Do | | --- | --- | | 🔍 Check your licenses | Run `npx license-checker --summary` in your project root | | 📖 Understand clean room law | Read the [Oracle v. Google](https://en.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_Inc.) ruling — it’s the precedent | | 🛡 Protect your OSS project | Add AGPL-3.0 if you want maximum copyleft protection | | 💡 See the satire yourself | Visit [malus.sh](https://malus.sh) and count how long before you question reality | | 🗣 Join the debate | [HN Discussion](https://news.ycombinator.com/item?id=47350424) — 200+ comments of devs processing grief | * * * _The funniest part about Malus isn’t that someone built it as a joke. It’s that three VCs probably emailed the founder asking for a demo._