A fake GitHub installer repo called actual-multi-display-configurator looked wrong to me, so I checked it without cloning it or running a line. It turned out to be one of dozens built from the same template. I read everything through the GitHub REST API, which only downloads text. I never opened the project's web page, and I never decoded the encoded script on it, so what follows about the payload is inference.
What looked off: stars without forks
The repo was five days old and had 767 stars and zero forks. Real projects pick up forks as they pick up stars, because people use them. The owner account was created in 2024, had no followers, and had two public repos. The other one was created four minutes before this one.
The profile also shows a Starstruck badge tied to this repo, a tier that needs 4,096 stars. The repo now shows 767. If that's right, more than 3,000 stars disappeared in days, which is what happens when GitHub bans a batch of fake accounts and their stars go with them. The badge outlived the stars.
The code is a prop
The description promises a multi-monitor configuration installer. The repo contains no display code. package.json is a Discord bot template named "sleek-kit", and src/index.ts is five lines that log in a Discord client. The changelog says "Initial release." The README badges for "CI: PASSING" and "STAGE: VERIFIED" are static images from shields.io, so no CI is behind them.
A GitHub Actions workflow that fakes activity
Inside .github/workflows/ sits a file with a random name, xSwanPlIsEx.yml. It runs every hour, waits a random number of seconds, then appends one line to a marker file and commits it with a three-word message pulled from a list ("bug rollback feature (2678)", "notify upgrade style (7917)"). The commit log looks like a busy project. Nobody is writing code.
This is the kind of thing that keeps a repo near the top of "recently updated" sorts and makes it look maintained to a casual visitor.
Where the payload probably lives: a ClickFix page
The README's main call to action is a "PowerShell Setup Button" that links to the repo's GitHub Pages site. That page is index.html, and it has a large base64 blob in a hidden input, several atob() calls on encoded strings, and a script that rebuilds the page at load time. Nothing in the repository's code is malicious, which means a scan of the repo itself finds nothing.
This pattern matches a technique usually called ClickFix: a fake "verify you are human" screen tells you to press Win+R and paste a command. The command pulls down an infostealer, which takes saved browser passwords, session cookies, crypto wallets, and tokens for services like Discord or GitHub. I have not confirmed that this particular page does that. Decoding it safely needs an isolated VM, and I haven't done that yet.
It is a campaign, not one repo
A GitHub code search for the same workflow text and marker file turned up five more repos with the same fingerprint. Then I looked at a "trending new repositories" list. About 28 entries shared the same shape: roughly 767 stars, about 287 new stars per day, four days old, mostly HTML, with names like "Autodesk Revit 2026 standalone", "Adobe Substance 3D studio", "Cellebrite UFED setup" and "Sketchup Pro pre-activated". Every title promises cracked paid software or a game trainer. The star counts being almost identical points to one botnet starring them all at once.
I matched those 28 on the listing text and star numbers alone. I haven't yet checked each one for the same workflow or payload.
Repos from the same campaign
These 25 repos matched the pattern on the listing alone: new, about 767 stars, mostly HTML, and a title promising cracked paid software or a trainer. I have not checked each one for the workflow or payload, so treat them as suspected, not confirmed. I left them as plain text on purpose, so nobody lands on one by accident. Don't run anything from them.
bipro45/actual-multi-display-configuratorSK-Dev666/rust-external-trainer-toolrdeepak-wq121/quicken-deluxe-installerthiagoaureliomartins-programador/chief-architect-premiermanjushree-iyer/soundpad-audio-suiteRolandoV3/metatrader-5-botleanislizarzado/ibm-spss-desktop-suiteayanprob/coreldraw-desktop-installerarthurrossetocampos1-crypto/uttorent-desktopMalik-825/sketchup-pro-desktopLeno27-Adr/autodesk-revit-2026-standaloneForgavin/ultra-iso-desktop-setupEriazeri/on1-photo-raw-max-configpastebin2019/multiaccountmanager-enhancementApp-MonicaWEB/auslogics-audio-studio-desktopdaiphu2708-crypto/melodyne-5-desktop-setupshayannazar84-hero/honkai-star-rail-companion-suitetianjanahary05-source/reason-14-installerwoo20080623-cell/cinebench-desktopangelonyn/chimera-desktop-suitehayfa1234/honkai-star-rail-enhancement-suitemahmoudtawfik1998/secure-pdf-document-processortheonlyoneexocctical-beep/cellebrite-ufed-setupAleRibeiro44/archicad-desktop-setupabdulmannanmalik13-wq/adobe-substance-3d-studio
If you see one of these in your own downloads, search history or browser history, follow the steps below.
How to spot a fake GitHub installer repo (indicators)
| Signal | What you see |
|---|---|
| Stars vs forks | Hundreds of stars, zero forks, repo under a week old |
| Description | Crack language: "2026", "pre-activated", "standalone setup", "all features enabled" |
| Language | Mostly HTML for a supposed desktop app |
| Code | Nothing to do with the stated purpose (here, a Discord bot template) |
| Commits | One every hour from github-actions[bot], all touching one file |
| Download | A button to a web page, not a release asset or readable source |
| Owner | New account, no followers, a second repo created minutes earlier |
If you ran something from one
Treat the machine as compromised. From a different, clean device, change passwords, revoke sessions and tokens, and check any crypto wallets. Don't just delete the file, since an infostealer has usually sent its data out by the time you notice.
If you only looked at the repo page, you're fine. The danger is in the page the button opens and the command it asks you to paste.
How to report fake installer repos on GitHub
Report each repo through the "Report repository" option on GitHub and choose the malware category. See GitHub's guide to reporting abuse or spam. Searching GitHub for an unusual marker file or workflow text, as I did, is a quick way to find siblings. If you maintain a package index, a software directory or a trending list, a filter on "fork count versus stars on a new repo" would have removed most of this cluster.
I'm planning to decode the page's blob in a sandbox and confirm what it runs. If I do, I'll post the result.
