One Guy With a Laptop Found 10,000 Fake GitHub Repos Booby-Trapped to Rob You AND Your AI
One Guy With a Laptop Found 10,000 Fake GitHub Repos Booby-Trapped to Rob You AND Your AInobody at github noticed for over a year. one bored dev noticed his own code got cloned, pulled a thread, and the whole sweater fell apart.
10,000 trojan repos. 40,000 updated every few hours to dodge scanners. 0 detections on the first virus scan. 1 solo researcher who mapped it all using free public data.
A dev who goes by Orchid noticed copies of his own project floating around GitHub — same code, same fake “contributors,” plus a sneaky download link that wasn’t his. He kept pulling. Turns out it’s a malware factory hiding in plain sight, and the new twist? It’s baiting AI coding bots too. Full writeup is here on his blog and Cybernews broke it wider.
so picture this. a trillion-dollar microsoft-owned platform, the literal home of all open-source code on earth, and one dude in his free time outpaced their entire abuse team. no cap, the receipts are public.
🧩 Dumb Mode Dictionary
| You’ll see this | It just means |
|---|---|
| GitHub | The giant website where coders store and share their code. Like Google Drive but for software. |
| Repo (repository) | One project’s folder on GitHub. Contains the code + history. |
| Clone | Making a full copy of someone’s repo — normal, legal, done a billion times a day. |
| Trojan | Malware disguised as something safe. Looks like a free tool, secretly robs you. |
| AI agent | A coding bot (like Cursor or Claude Code) that can go fetch and run code on its own. |
| README | The “front page” text file of a repo. The crooks edit this constantly to look “active.” |
| gharchive | A free public log of EVERY action on GitHub, every hour. Anyone can download it. This is the hero’s weapon. |
🔍 How one guy unravelled the whole thing
- Orchid saw repos that were straight-up clones of his own project — but with an extra malware download link slipped in.
- He noticed something weird: these repos delete and re-push the same commit every few hours. Why? To look freshly “maintained” so GitHub ranks them high and scanners think it’s normal upkeep.
- So he wrote a script that chewed through 16 million GitHub events over 5 days (free gharchive data), filtering for that exact heartbeat: README-only edits, 1–24 times a day, not from a bot.
- 14 repos → 3,000 → 40,000 suspicious → 10,000 confirmed carrying the same trojan.
- Some have been live over a year. Detection? Zero, on the first scan. The bad file only lights up once you unzip it.
🎮 The bait: free game cheats, cracked software, and now... robot coders
The fake repos pose as exactly what people desperately search for: game cheats, cracked Photoshop, free Spotify mods, “exploit” code. You download the zip, run the .exe, and boom — a thing called SmartLoader/StealC quietly empties your saved passwords and crypto wallets. Trend Micro flagged this same playbook getting AI-assisted last year.
The 2026 plot twist? Security folks are calling a related version the “OpenClaw Trap” — repos written to fool AI coding agents that auto-clone whatever ranks highest in search. The bot grabs the poisoned repo, you say “yeah run it,” and you just got robbed by a robot you trusted.
📊 The receipts
| Number | What it is |
|---|---|
| 10,000 | Confirmed trojan repos |
| 40,000 | Repos updating every few hours to dodge scanners |
| 16,000,000 | GitHub events Orchid sifted to find the pattern |
| 1+ year | How long some have evaded GitHub’s checks |
| 0 | Antivirus hits on the first scan of the archive |
| 109 → 10,000 | Jump from the earlier April 2026 Hexastrike count to the full picture |
🗣️ Why this one hits different
The crooks aren’t cloning famous repos (too watched). They clone brand-new small ones, inject the malware, and because the clone gets the frequent fake “updates,” it outranks the original in GitHub search. The real author’s project ends up buried under its own evil twin.
It’s a search-ranking exploit wearing a malware costume. And the scariest part — it was beatable by ONE person with public data and a weekend. Which means GitHub could’ve caught it. They just… didn’t.
Cool. A Solo Dev Just Bodied GitHub’s Security Team. Now What the Hell Do We Do? (ง •̀_•́)ง
Here’s the thing nobody’s saying out loud: the same free public data that exposed 10,000 crooks is sitting right there for YOU. The crooks built a machine. The hero built a flashlight. Both used $0 tools. So can you. Five angles 
🕳️ The gharchive Goldmine
Orchid’s detection trick — spotting repos that re-push the same README every few hours — is now a public recipe. Build a dead-simple “paste a GitHub link → is it poison?” checker using the free gharchive firehose and park it where desperate downloaders live: game-cheat and cracked-software Discord servers.
Example: A 21-year-old in the Philippines runs a tiny Discord bot inside cheat-sharing servers. Someone drops a GitHub link, the bot checks it against the README-churn pattern, replies “
matches the trojan fingerprint” or “looks clean.” Tip jar + server boosts. Pulls ~$600/mo from grateful gamers who’d rather pay $2 than lose their Steam account.
Timeline: First paying server in ~10 days. Stays good until GitHub finally automates the same check (could be months — they’ve sat on it a year already).
📡 The Allowlist Vendor (sell the shovels)
Everyone running an AI coding bot (Cursor, Claude Code, whatever) now has a real fear: their bot auto-cloning a poisoned repo. Sell them peace of mind — a daily-updated blocklist of known-bad repo fingerprints they can plug into their setup before the bot fetches anything.
Example: A 26-year-old in Brazil maintains a simple JSON blocklist hosted free on GitHub itself, sells access through Gumroad at $5/mo. Devs wire it into their agent’s “before you clone, check this list” step. Sitting at $1.4k monthly recurring — boring infrastructure nobody else bothered to package.
🪟 The Ranking Mirror (steal their trick, use it for good)
The crooks rank above real projects by faking “freshness” — constant tiny commits. That’s not malware, that’s just a GitHub search-ranking hack. Flip it white-hat: offer indie tool-makers a legit setup that keeps THEIR real repo looking active, so it outranks the evil clone of it.
Example: A 23-year-old in India sells a one-time setup: a GitHub Action that makes small honest updates on a schedule, pushing a dev’s genuine project back above its trojan twin in search. Charges ~$40 per repo, done in an afternoon. Word spreads fast among small open-source authors who got cloned.
🎣 The Honeypot Landlord
Spin up your OWN decoy repos that match the malware fingerprint exactly — they’re yours, totally legal. Then watch who clones, forks, or phones home. The data on who’s running this operation is worth money to threat-intel folks, and GitHub pays for some abuse reports.
Example: A 24-year-old in Poland runs 30 honeypot repos that look like juicy “exploit” code, logs every callback the loader tries to make, and sells the cleaned-up list of bad infrastructure to a small threat-intel newsletter. One solid data drop netted ~$900. Researchers love primary-source dirt.
🧩 The Inline Snitch Extension
Be the first to ship a free browser extension that paints a GitHub repo page red the second it matches the clone pattern — README-only commit churn, fake contributors, no real code history. Free tier flags, paid tier shows the full forensic breakdown.
Example: A 19-year-old in Nigeria ships a Chrome extension that adds a warning banner on suspicious repos. Free for everyone, $3/mo “pro” tier unlocks the deep commit-history view. Hit 1,200 installs off one viral Reddit post, ~$300/mo and climbing. First-mover owns the keyword.
🛠️ Follow-Up Actions
| Want to… | Do this |
|---|---|
| See the raw GitHub firehose | Grab free hourly data at gharchive.org |
| Read the original detective story | Orchid’s full writeup |
| Understand the malware family | Trend Micro’s breakdown |
| Automate repo “freshness” | Learn GitHub Actions |
| Sell a tiny digital product | Set up Gumroad in 10 min |
Quick Hits
| You want | Do this now |
|---|---|
 Not get robbed |
NEVER run a downloaded .exe from a random repo — scan the unzipped file, not the zip |
 Safe AI coding |
Don’t let your bot auto-clone top search results blindly — pin known-good repos |
 Spot a fake |
Check the commit history — real projects edit code, fakes only spam “Update README.md” |
 Make a move |
Pick ONE hustle above and ship the ugly version this weekend |
 Stay ahead |
Follow Cybernews — they break this stuff before it’s everywhere |
one bored dev, free public data, a weekend. that’s all it took to embarrass the biggest code platform on earth. your move isn’t “wait for the suits to fix it” — it’s “grab the same flashlight before everyone else does.”
!