A security researcher just walked through how anyone can find thousands of malware-hosting repositories on GitHub using nothing but the site’s own search bar. The write-up, which climbed to the front page of Hacker News, poses a blunt question: what does GitHub’s security team actually do? This is significant because the barrier to finding this stuff isn’t technical skill or insider access. It’s a search query.
What the researcher found
According to Hacker News, the scheme works like this. Attackers spin up repositories with near-identical README files. Each one includes a download link to a zip archive, and each archive hides a Trojan. Submit the files to VirusTotal and the malware flags light up.
The repositories share obvious fingerprints:
- Nearly identical structure and headings
- Every heading carries an emoji (the giveaway is a “📥 Download” header)
- Download links pointing to githubusercontent.com or github.com
- Zip names with version numbers, like “Software-3.6.zip”
Those patterns are all you need. The researcher started with a search for the download heading, added a filter for “.zip” links, then had a free AI model write a regular expression to catch the versioned archive URLs. Result counts jumped around wildly, from a few hundred to 4,400 in a single run, but the malicious repos kept surfacing.
The part that stings
Here’s what makes this more than a routine malware story. The researcher published a detailed breakdown a month earlier, along with a script that found 10,000 of these repositories and the full list of links. It hit the Hacker News front page. Other security outlets covered it.
GitHub’s response, per the account: they deleted the 10,000 repositories the script identified. And that was it. Hours later, the same script found fresh ones. A month passed and those new repos stayed live. The researcher’s point lands hard. GitHub clearly knows about the scheme. They acted once, reactively, on a handed-to-them list, then stopped.
Why this matters now
GitHub is owned by Microsoft, a company with billions in revenue, a dedicated security team, and its own Copilot AI baked into the platform. The researcher’s frustration is that catching these repos looks like a few days of work for one employee with the right query. So the gap here isn’t capability. It’s prioritization.
That’s the real story for the industry. Platform-scale abuse detection is a resourcing and incentive problem as much as a technical one. Reactive takedowns clear a headline. They don’t touch the pipeline generating new malicious repos every hour. Automated, pattern-based detection running continuously is the obvious fix, and the researcher showed a solo effort can build a rough version in an afternoon.
There’s a broader tension worth naming. As AI makes it trivial to both generate and detect these patterns, the asymmetry cuts both ways. Attackers use free models to spin up convincing repos at scale. Defenders can use the same tools to hunt them. Whoever automates their side wins the volume game. Right now, based on this account, the attackers are automating and the platform is doing manual cleanups.
Takeaways for practitioners
If you build on or pull from GitHub, treat this as a live threat, not a hypothetical:
- Never trust a zip download linked from a README, even on a repo with stars or activity. Run anything through VirusTotal first.
- Pull dependencies from package registries and verified releases, not raw archive links buried in documentation.
- If your team runs a platform with user-generated content, learn from this. Reactive takedowns on a supplied list are not a security program. Continuous pattern detection is.
- Security teams should assume that if an outside researcher can find abuse with a public search query, so can everyone else, including the next attacker studying the same patterns.
One caveat on sourcing. This is one researcher’s account of GitHub’s response, and the search result counts they report swing dramatically, which points to indexing quirks in GitHub’s own search. GitHub hasn’t publicly detailed its side. Still, the core demonstration stands: the malicious repos are findable, they persist, and the fix looks cheaper than the reputation cost of leaving them up.
What happens next depends on whether platforms treat abuse detection as ongoing infrastructure or occasional cleanup. Full details are at the original source.