I found 1000 GitHub repos with malware. Can we get them deleted?

As another data point: MSFT have some sort of open mail server/service called onmicrosoft.com which (in my experience anyway) is only being used to send out fraudulent paypal messages. Because it lets the spammer set the From to service@paypal.com and also contains valid DKIM etc, it sails past spam filtering. There are so many complaints about this on (real) paypal.com forums, but Microsoft are apparently unable to do anything about it.

> 9 years ago

> This is still coming. The work is being completed now and we will be able to expose it in a few months.

I'm glad the official response has no date associated, so you won't know whether they published that yesterday of 8 years ago.

There used to be some sort of forum they had, I don't remember what it was, MSDN forums or Technet or something, but it used to dominate search results, and all the answers were from like, senior hobbyists who couldn't suggest much more than restarting or suggesting checking for updates. Maybe that was before every search result was Reddit or SO though.

One thing I appreciate about Github is that every time I've reported something, I've felt like an actual human went through my report and actually read the things I wrote. Perhaps it's a bit silly to appreciate basic human interaction, but for so many online environments the only interaction you'll ever see is done through chatbots and automated work flows.

> response times may vary

Waiting six months for Github to remove malicious repositories is unacceptable.

There is an official policy on this: https://docs.github.com/en/site-policy/acceptable-use-polici...

So, sounds like the Github team should take some action here.

I don't think that repositories presented and named as Malware or Virus should be deleted - they're good for educational and research purposes I guess. I specifically mean those that impersonate as legit programs (if you can call a "free download" or "mod" apps legit).

Maybe a special flag with a passcode which must be passed to `git clone`, where this passcode is shown in such a banner. To make sure you've read the banner.

To me those repos seems an abuse of what GitHub is for. I'm 100% fine with a repo hosting malware if it's there for security researchers and anybody else interested in the topic to study, etc. Even better if there is also documentation. I'm not fine with using GitHub (or any other site) as a distribution platform for malware, hiding the fact that the software is malicious in the first point.

Good point instead of deleting, treat it like an invalid https cert. Lots of warnings and are you sures before you get to clone or fork.

Only if they disguise as non malware I guess?

> would be distributed some other way if GH removed them

Maybe? But definitely to less people? I don't see the argument for allowing them.

Doesn't distributing malware break a number of laws?

You're describing Qubes, which is great but I found it tedious to use as a daily driver.

When GoodbyeDPI malware was spreading using the similar template (lots of forked repos with password-protected archives), Github abuse team have instantly deleted it upon my request. Mean response time was 10-15 minutes.

I also deleted files on the file sharing websites, such as mediafire and mega.

My abuse emails followed the clear and understandable email template: your service is hosting malware, here's the link, it's password protected and the password is X, here are virustotal results, here's the original repo which it impersonates, and I want you to delete it.

https://excalidraw.com/ probably

I'm not familiar with the context here, could you please elaborate? If I understood correctly, any unauthenticated user can delete the webhook? I can currently find hundreds of matches for that on Github, anyone could just go and delete them all?

An unscrupulous individual might even send malware.