Reports indicate that a 'malicious imitation software' was reported to GitHub but ignored for over three weeks, only to be removed within 10 minutes once it became a topic of discussion online.



In September 2026, software developer Andy Bryce posted a blog about reporting 'malicious imitation software' on the software development platform GitHub, but having his report ignored for over three weeks. Despite GitHub's failure to address Bryce's report for over three weeks, the problematic page was removed as soon as the blog became a hot topic on the social news site Hacker News.

Github has not removed malicious imitation software after 3 weeks | Successful Software

https://successfulsoftware.net/2026/09/24/github-has-not-removed-malicious-imitation-software-after-3-weeks/

Bryce, who lives in the UK, sells software called Easy Data Transform , which allows users to organize and visualize large amounts of data using drag-and-drop functionality, without requiring any coding or spreadsheet software.

On August 31, 2026, Mr. Bryce received an email from an Easy Data Transform customer reporting that there was a counterfeit version of Easy Data Transform on GitHub. Below is a screenshot of the page of the counterfeit product that was actually published on GitHub.



The product name and logo on the counterfeit product's GitHub page were being used without permission from Easy Data Transform, and Bryce contacted GitHub that same day. GitHub responded that they had received Bryce's report but were unable to take immediate action.



While waiting for a response from GitHub, a colleague scanned the Mac files distributed on that GitHub page using

virustotal.com , a website that scans files and websites for malware. The results showed that the files distributed on GitHub contained a large amount of malware, as follows:



Furthermore, it was discovered that the file contained an image urging the downloader to ignore a malware warning.



Bryce reported this additional information to GitHub on September 10, but even on September 23, more than three weeks after his initial report, he had received no response from GitHub other than the initial automated email. Unsure of what to do next, Bryce published a blog post detailing the events and advising people to 'always download software directly from the vendor whenever possible.'

Then, Bryce's blog post, in which he claimed that 'GitHub is neglecting malicious imitation software containing malware,' became a major topic of discussion on the social news site Hacker News.

GitHub has not removed malicious imitation software after 3 weeks | Hacker News
https://news.ycombinator.com/item?id=49832406

Just 10 minutes after the thread about Bryce's blog appeared on the Hacker News homepage, GitHub finally removed the page in question. The following email from GitHub to Bryce states that they reviewed the account and found a violation of GitHub's Terms of Service, and that appropriate action has been taken.



In a comment to Hacker News, Bryce said, 'The lesson of this story is, 'If you want even minimal support from GitHub, you first need to be featured on the front page of Hacker News.' It seems GitHub can do things very quickly if they want to. Damn it!'



Related Posts:

in Web Service, Posted by log1h_ik