On 31 August a customer told Andy Brice (Easy Data Transform) that someone had put an imitation of his data-wrangling product on GitHub, using his product name and logo without permission. He reported it that day and got an automated reply. A colleague then scanned the repository’s macOS .dmg with VirusTotal and found a wall of malware detections.
It got worse. The disk image’s background had been replaced with artwork telling downloaders to ignore warnings about malware — a direct attack on the OS’s own protection story, shipped from the world’s default code-hosting platform.
He sent that evidence on 10 September. On 23 September there had still been no response from GitHub support beyond the original automated email.
- Twenty-three days, no human reply
- Malware detections already attached to the report
- The obvious next step is a DMCA takedown, which is an awkward fit for impersonation
- Meanwhile the artifact kept serving downloads under his name
The ending is the finding. GitHub removed the repository about ten minutes after the post reached the front page of Hacker News. Brice’s conclusion: if you want even the most basic level of support from GitHub, get on the front page of Hacker News.
Nothing about the evidence changed between 10 September and 24 September. Only the audience size did. Abuse triage that responds to publicity rather than severity is an incentive problem, not a headcount problem — and it leaves the smallest software vendors with no escalation path except going public.
The practical lesson is narrower than the outrage: any distribution channel you do not control adds takedown latency you cannot influence. Download software from the vendor where you can.