GitHub has not removed malicious imitation software after 3 weeks
A developer waited three weeks for GitHub to remove a malicious imitation repository distributing malware, only for it to be taken down minutes after hitting Hacker News.
summary is enough The post is a brief incident report that is fully grasped through its summary and title.
summary
A software developer discovered a malicious GitHub repository impersonating his product and distributing malware via a modified DMG installer. Despite reporting the imitation and malware evidence, he received no human response from GitHub support for over three weeks. The repository was abruptly removed just ten minutes after the blog post reached the front page of Hacker News. Commenters share similar experiences with unresponsive platform trust and safety teams and discuss alternative escalation tactics like DMCA notices.
key points
- GitHub ignored reports of an imitation repository distributing malware that instructed users to bypass security warnings for 23 days.
- The repository was removed ten minutes after reaching the Hacker News front page, highlighting how public visibility forces platform action.
- Commenters note that filing formal DMCA takedown notices often bypasses dead-end support queues by enforcing legal response timelines.
who should read it
Independent software vendors and developers concerned with product impersonation and platform trust and safety.
discussion skeptical
consensus
Commenters widely agree that major tech platforms have broken or unresponsive trust and safety queues, often requiring public shaming or Hacker News visibility to get basic action.
pushback
A minority of commenters defend GitHub by pointing out the massive volume of abuse reports and arguing that the timing relative to the HN post was pure coincidence.
If it's your software send a DMCA. They have a legally required timeframe to process those. If it's open source, however, then you don't have any valid DMCA claim.
It provides actionable advice by pointing out that formal DMCA notices trigger legally mandated processing windows compared to standard abuse reports.
Generated by an LLM from the article and thread. Check the sources before relying on it.