Jun 18, 2026, 10:23 PM@nixCraft great work! 🫡🥰
Just a point of clarification question. When you say: 'Each of these repositories contains a zip archive with a Trojan.'
Is this a link to a zip archive in README.md? Or does this zip archive decompress and auto execute on a Windows system when the repo is downloaded?
This could be evidence of complicity, no? An AI with access to thousands of repos suggests an inside job?
Thank God i switched to Codeberg.org a while back...
Jun 18, 2026, 10:36 PM@nixCraft if these are public repos, could there be an SEO aspect to this?
Lots of backlinks from git to a zip archive trojan url could rise this url up the results pages on Google?
Just a thought...
Jun 18, 2026, 11:49 PM@handi @nixCraft i think it's highly likely this behavior is SEO. both the targeting of new repos that don't yet have a big search engine presence, and the frequent updates to make it look like the most recently updated hit. slop farms use similar tactics by constantly republishing the same articles over and over to pump up their relevancy in search engines.
@drikanis You're absolutely right.