GoKawiilGitHub took 23 days to remove malware-laced clone of Easy Data Transform
A customer alerted Easy Data Transform's developer to a fake GitHub repository impersonating the company's product name and logo, hosting a Mac .dmg file flagged by VirusTotal as malware. The developer reported the imitation to GitHub on August 31 and submitted further evidence on September 10, but received only an automated response until the listing was finally removed on September 24, shortly after the issue reached the front page of Hacker News.
GoKawiil's interpretation of the reporting above, not reported fact.
The delay highlights concerns raised by the developer about how platforms like GitHub handle abuse reports for fraudulent or malicious content impersonating legitimate software vendors. The quick takedown following public attention on Hacker News suggests, according to the developer, that visibility rather than the report's merits may drive moderation response times, though GitHub has not confirmed this. Incidents like this could erode trust in software marketplaces if legitimate reports are seen as ineffective without public pressure.
- A fake GitHub repo mimicked Easy Data Transform's branding and distributed malware-flagged software.
- GitHub took 23 days to act despite two detailed abuse reports, only removing it after Hacker News exposure.
- The developer suggests public visibility, not the report itself, may have prompted GitHub's quick action.
Malwarebytes Premium Antivirus — If you've downloaded software from unofficial sources, running a scan with Malwarebytes can help catch malicious imitation apps like the one described in this article before they cause harm. It's a solid layer of protection against fake software downloads and other malware hiding in disguised installers.
See Malwarebytes Premium Antivirus on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: successfulsoftware.net — Andy Brice, 2026-09-24
Published there as: “GitHub has not removed malicious imitation software after 3 weeks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.