GitHub took 23 days — then acted in 10 minutes after Hacker News
Original: GitHub has not removed malicious imitation software after 3 weeks
Why This Matters
GitHub's slow abuse response leaves malware repos live for weeks, putting users at risk.
Independent developer Andy Brice reported a malicious imitation of his Easy Data Transform software on GitHub on August 31. The fake repo used his product name and logo, and distributed a .dmg file flagged by VirusTotal as malware. GitHub support was silent for 23 days — until the post hit the front page of Hacker News, after which the repo was removed within 10 minutes.
On August 31, a customer alerted developer Andy Brice that a fake repository on GitHub was impersonating his data-wrangling tool Easy Data Transform, using its name and logo without permission. Brice reported it to GitHub the same day and received only an automated reply. A colleague scanned the distributed Mac .dmg file on VirusTotal and found multiple malware detections. Further analysis with IsoBuster revealed the .dmg's background image had been swapped for one instructing users to dismiss any security warnings — a classic social engineering tactic to help malware slip past defenses. Brice filed a follow-up report on September 10 with this additional evidence. By September 23, 23 days had elapsed with no further response from GitHub support. Brice published a blog post calling out GitHub's inaction, which reached the front page of Hacker News on September 24. The offending repository was taken down approximately 10 minutes later. Brice noted sardonically that GitHub appears capable of fast action — when public pressure demands it. He added that realistic victims are mostly users trying to pirate the software, though he stressed: 'I really don't like bad guys taking advantage of my hard work.' His advice: always download software directly from the vendor.