GitHub has not removed malicious imitation software after 3 weeks

Original Article ↗ Hacker News Discussion ↗

GitHub is under fire for taking weeks to remove a malicious repository impersonating a commercial app, despite reports that it was distributing malware. Commenters argue over whether victims should resort to DMCA notices or trademark claims, and highlight how public shaming on sites like Hacker News often triggers faster action than standard support channels. More broadly, the exchange reflects frustration with understaffed moderation at large tech platforms, whose incentives favor growth and AI features over robust user protection.

Imitation repo, malware, and DMCA

  • Several commenters recommend DMCA takedowns as the most effective way to get GitHub’s attention.
  • Others clarify DMCA only applies to copyright, not to “things you don’t like” (e.g., malware per se). Sending knowingly baseless notices is described as illegal.
  • Clarifications:
    • Open source code is still copyrighted; licenses grant specific reuse rights.
    • Logos are automatically copyrighted and may also be trademarks; copying a project’s logo can create a valid copyright claim even if the code is open source.
    • Open source licenses generally don’t ban “malware derivatives,” so the violation must be about copying or license terms, not behavior.

GitHub moderation and responsiveness

  • Multiple anecdotes of slow or absent action on: malware repos, impersonation accounts, squatted names, and “nulled” commercial software.
  • Others report reasonably fast responses (hours to a day) on spam and malware tickets.
  • Thread consensus: support and moderation are understaffed relative to GitHub’s scale.

HN visibility and escalation

  • The offending repo in the article was removed shortly after the HN thread appeared; some see this as clear cause, others as coincidence.
  • Many insist large companies actively monitor HN and other social channels and do rapid, high-priority escalations when an issue becomes public.
  • Similar patterns reported for Google, Apple, YouTube, app stores, etc.

Corporate incentives and “malice”

  • Debate over whether under-staffing support is “malicious” or just rational profit-seeking.
  • Some invoke fiduciary duty to investors; others counter that law does not require profit maximization at the expense of everything else.
  • Broad frustration that highly profitable companies choose minimal human support and moderation.

Limits of current reporting systems

  • First-line support is often automated, second-line underpowered, and specialized teams hard to reach.
  • Abuse/spam reports are framed as an externality: most users don’t need them, but victims have no alternative platform.
  • Suggestions include regulatory SLOs for live human support and more staff instead of “throwing AI at the problem.”

Wider moderation problems

  • Commenters see similar issues across platforms: fraudulent listings, scam videos, malicious ads, and counterfeit downloads staying up for days or longer.
  • Imitation attacks are said to be getting more polished, using real product names and logos, increasing the risk to users.