A macOS installer that impersonated a paid app stayed on GitHub for three weeks despite trademark and malware reports, and only came down after Hacker News: Reveneau

Why it mattersA team that publishes a named commercial application has to watch for typosquats on GitHub itself, because the standard trademark and malware reporting paths did not act on this one until the story reached a public audience.

If your company ships a named commercial application, GitHub itself is now a place your typosquatters live. Andy Brice, who publishes the data-wrangling tool Easy Data Transform, wrote up on 2026-09-24 how a malware-carrying macOS installer using his product's name and logo sat on GitHub for 23 days after he first reported it, and only came down within ten minutes of his account of the delay reaching the front page of Hacker News.

The timeline, from the writeup

Per Brice's post on the Successful Software blog, a customer alerted him to the imitation .dmg on GitHub on 31 August. Brice reported it to GitHub the same day as a trademark and intellectual property violation. On 10 September he sent follow-up evidence, including a VirusTotal report showing multiple antivirus engines flagging the file as malicious. On 23 September, 23 days after the first report, he had received nothing from GitHub support beyond the original automated acknowledgement.

He published his account on 24 September. Once the post reached the top of Hacker News, GitHub removed the file "in about ten minutes" (his words). His conclusion, quoted verbatim: "If you want even the most basic level of support from GitHub, you need to get on the front page of Hacker News."

What the fake installer did

Brice writes that the .dmg reused his product name and logo without permission. The installer's background image had been modified so that it encouraged users to ignore the macOS malware warning. The VirusTotal check he attached to the second report showed multiple engines detecting the payload.

Brice notes that the profile of a likely victim is not his paying customer, since paying customers download from his own site. It is somebody trying to avoid paying for a licence and pulling the file off a search result on the product name. That population is small, but the point of a typosquat is that it does not have to be large.

What a publisher can do this week

Two practical things a small publisher can act on. First, monitor GitHub for repositories carrying your product name, your installer filename, and your download page URL. GitHub has a code search API and a repository search API that make a scheduled query cheap. Set a threshold that pages a human on any hit that carries the trademarked term outside your own organisation.

Second, when a hit lands, file both a DMCA notice and a malware report on the same day, and keep a copy. Brice used the trademark and IP path first. His experience suggests that, for a file the reporter already knows is malicious, the malware-abuse path should be filed alongside it rather than after, and the reporter should keep the case ID for a public follow-up if the response is slow.

The one-line lesson is unpleasant: on 2026-09-24, the fastest working escalation path from a trademark holder to GitHub abuse response was a blog post that reached Hacker News. That is a working plan, but nobody should have to build a growth funnel to get their brand back.

Source

GitHub has not removed malicious imitation software after 3 weeks, Successful Software, Andy Brice, 2026-09-24
Hacker News discussion

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.