I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts.

In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participated on those servers with clearly illegal purposes. They’ll come back and make new accounts again, of course, but having them lose all of their connected servers, history, and requiring them to update every single one of their malware drops should slow them down considerably.

This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will do them no matter what, we should make it safe for them to the extent we can. False positives, causing people to ignore actual positives, creates a market for these things.

Serious question. The repos aren't themselves doing harm, are valuable for research, and would be distributed some other way if GH removed them. Maybe a banner “be careful! others have reported that this repo may not do what it claims. proceed with caution” would be a more appropriate response?

Just curl -X DELETE https://discord.com/api/webhooks/[...]

If I download and install a mod for minecraft, it should never have access to anything on my computer, except for the minecraft game files itself. If I open a spreadsheet in Excel, the excel process should have access only to that file and it's own config files.

Something similar to how android works, were the app has to explicitly ask the user to access their files.

When searching for it I found multiple, some had download from github repos. None was looking trustworthy enough, so I didnt download any. But I hesitated a little.

From how they looked, I think now that was the kind of malware the author describes.

Most fun you can have is to generate real-like looking data (there are tools for that) and mass send them to these discord webhooks.

;-)

Also, I am seeing firsthand that AI is not good at detecting this stuff. Claude's main problem in a code review of one of its descendants was the unethical use of an aim-bot.

edit: to clarify, my concern is about how this can exist on Github for 3 years. Thank you for compiling this and sharing your review. Great work.

Like everything else, you shouldn't blindly search on github - or any other download site.

Only download from links referred from the official site if there's any, or the game's forum, or any other trustable and human reviewed source.

Less then 10% of them have open issues with complaints - others look just fine.

I don't know why anyone running one of these schemes to distribute malware would even enable the issues tab on github, let alone not delete every issue posted containing keywords like malware, trojan, virus, etc. with a script.

Are hidden until approved issues not supported on github? Is this caused by some limitation of creating these repos programmatically?

Yes, Redox creates and starts sqlite to gather all the data in a good-looking way.

Is that saying it creates a sqlite database? I kind of doubt it. I think more likely is it uses sqlite to read from existing sqlite databases that exist on disk, to steal data from them.

Better to have an attitude that Github is malware and a healthy skepticism of any repo?

Some honeypot scheme or social engeneering against them.

Ideas?

Microsoft is alright in my book. Let GitHub be free.

Maybe could stop people from being able to git pull them without a confirmation, but deleting does not make sense

I guess the problem is that only helps those who already know they need to watch out for this sort of thing, not the users most likely to be pwned.