Vibe Coding2026-09-25 · source-backed

GitHub left a malware repo impersonating a real product up for three weeks, then removed it ten minutes after an HN front page.

Issue

2026-09-25

Confidence

source-backed

Sources

Redaction

redacted

Story

The developer of Easy Data Transform reported a fake repo reusing their product name and logo and shipping a malicious macOS .dmg on August 31, sent more evidence September 10, and got only an automated reply. It came down about ten minutes after their September 24 post reached HN's front page with 258 points. (writeup) Check owner and fork status before installing a binary from a repo you found by searching, because the abuse-report path evidently has a different SLA than the front page.

Source trail

writeup More from successfulsoftware.net

Entities

August Check Easy Data Transform GitHub September SLA

Provenance

Canonical issue: Ramsay Research Agent — September 25, 2026
AI generated: no
Story unit: 2026-09-25-github-left-a-malware-repo-impersonating-a-real-product-up-for-three-weeks-then-removed-it-ten-m
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

GitHub left a malware repo impersonating a real product up for three weeks, then removed it ten minutes after an HN front page.

Story

Related stories

hydra-db gained 794 stars in a day while its last commit was August 19 and it has never cut a release.

Basecamp is shipping first-party agent skills for HEY email, five releases in eight days.

Codex CLI on Bedrock can't opt into prompt caching, and one user's logs show 85% of a $1,386 bill was cache writes.

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

Cline left the IDE.

Claude Code's weekly limits change on September 14, and it's a cut against what you have today.

Source trail

Entities

Provenance

GitHub left a malware repo impersonating a real product up for three weeks, then removed it ten minutes after an HN front page.

Story

Related stories

hydra-db gained 794 stars in a day while its last commit was August 19 and it has never cut a release.

Basecamp is shipping first-party agent skills for HEY email, five releases in eight days.

Codex CLI on Bedrock can't opt into prompt caching, and one user's logs show 85% of a $1,386 bill was cache writes.

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

Cline left the IDE.

Claude Code's weekly limits change on September 14, and it's a cut against what you have today.

Source trail

Entities

Provenance

Story

Related stories

hydra-db gained 794 stars in a day while its last commit was August 19 and it has never cut a release.

Basecamp is shipping first-party agent skills for HEY email, five releases in eight days.

Codex CLI on Bedrock can't opt into prompt caching, and one user's logs show 85% of a $1,386 bill was cache writes.

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

Cline left the IDE.

Claude Code's weekly limits change on September 14, and it's a cut against what you have today.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance

Story

Related stories

hydra-db gained 794 stars in a day while its last commit was August 19 and it has never cut a release.

Basecamp is shipping first-party agent skills for HEY email, five releases in eight days.

Codex CLI on Bedrock can't opt into prompt caching, and one user's logs show 85% of a $1,386 bill was cache writes.

gap-trap's "Proven Red" gate runs every new test against the old code and fails when it passes.

Cline left the IDE.

Claude Code's weekly limits change on September 14, and it's a cut against what you have today.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance