What does GitHub's security team even do?

What does GitHub’s security team even do?

Right now, there are thousands of repositories on GitHub that are spreading viruses. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website.

These repositories have been around for two years. GitHub has billions of dollars, a security team, and artificial intelligence. Why haven’t they solved this problem in two years?

First, we’ll look at the repositories we’ve already found, identify common patterns within them, and then use those patterns to find other repositories.

Take a look at these repositories; in each one, the readme contains a link to a zip archive containing a Trojan:

• https://github.com/respawningcode/OpenAi-Sora
• https://github.com/idrissof/keyrad
• https://github.com/lowwkezer/shannon
• https://github.com/ramacuy/ai-excalidraw
• https://github.com/McuMirror/DWIN-T5L-SDCC-Template

If we download this zip archive and submit individual files from it to VirusTotal, we’ll see the following results:

Even a quick glance at these repositories shows that they have the same structure, nearly identical headings, and every heading contains an emoji. That’s all the information we need to find other repositories.

Let’s use the heading "📥 Download" and search for that string on GitHub. But we don’t want to search the entire codebase — just the readme files. Go to github.com and enter the following in the search bar at the top:

path:readme.md "## 📥 Download"

The number of results will always vary. At first, it showed me 9k repositories, but when I went to page 2, there were only 109 repositories. After refreshing the page, it was back to 9k repositories.

In the search output, you’ll need to visually filter out the results that contain any other text besides just the heading. The heading variations will look something like this:

• 📥 Download Now

• 📥 Download Now Again

• 📥 Download the Software

• 📥 Download & Install

Open these repositories. They will have a link to a zip archive containing a Trojan.

However, the search results will include many legitimate repositories. We can improve the search by adding a search for zip archives. The search string will look like this:

path:readme.md "## 📥 Download" ".zip"

This will significantly improve the results. Now, right in the search results, we can see which repositories contain the heading we need and a link to a zip archiv