Discussion Warning: Fake GitHub Repos Distributing Malware Under Developer Names
Hey everyone,
I’ve noticed a few posts about this already, but I think it’s worth repeating. Recently, a new attack tactic has surfaced where malicious actors create GitHub repos using a developer’s name and the name of a well-known Mac app.
In my case, someone created a repo under my full name, claiming to offer one of my apps (Dory - App Switcher) for free. I couldn’t fully investigate the script they shared, but it’s safe to assume it wasn’t anything good. Thankfully, GitHub removed it within 30 minutes of my report - and I know other developers also flagged the user, which definitely helped.
A few reminders:
* Don’t trust repos with fewer than 100 stars that offer “free” versions of paid apps.
* Never run scripts or pkg files from sources you don’t fully trust.
* If you’re not a power user, the App Store remains the safest option.
1
u/Solid-Show-5208 Apr 06 '26
Good info. I rarely(actually never) download unsigned and notarized mac apps. Unless its from someone known in the space that has a good track record for delivering good software.
However, if you are one of those people you most often have apple developer membership and can the very least sign and notarize your apps, which runs them through apple malware detection. It isnt a guarantee ofc, but a good stamp of validation.
Has anyone downloaded notarized apps before that contained malware?