An independent researcher says they identified about 10,000 GitHub repositories distributing Trojan-infected archives by cloning legitimate projects and adding download links to their README files. The finding is documented in a first-person investigation on Orchid Files, together with a public list and a detection script. The count and malware characterization come from that researcher’s analysis rather than a GitHub or law-enforcement report.
The investigation began when a Bing search for the author’s own project returned a different repository with the same name, description, commit history and contributor attribution. The copy contained a newer README change linking to a ZIP archive. A second lookalike project surfaced through GitHub topics with the same pattern. The repositories repeatedly replaced their latest commit with an apparently identical update, keeping the malicious-looking link fresh while preserving a borrowed development history.
The author initially reported two examples to GitHub. According to the account, support removed them after roughly six weeks. VirusTotal returned no detection when given only the archive URL, but flagged a Trojan when the ZIP itself was uploaded, illustrating how a clean link scan may not reflect the file eventually delivered. Users should not treat that observation as proof that every antivirus engine or archive behaved identically.
To estimate the campaign’s scale, the researcher used GH Archive rather than attempting to query hundreds of millions of repositories individually. Five days of public activity contained about 16 million push events. An early filter searched for projects updated every few hours, with one README modification and an archive link, but found only 14 matches. Manual review showed that update frequency was the wrong assumption and that some replacement commits registered no file changes.
A revised search examined repositories updated between one and 24 times per day and looked for a latest commit titled “Update README.md.” It narrowed roughly 40,000 candidates to 10,000 matching the full pattern, the author says. Those repositories came from different accounts, used different names and were not GitHub forks, making ordinary network relationships less useful for discovery. Some had reportedly remained online for months or more than a year.
The researcher’s theory is that attackers copy newer projects to rank for low-volume search terms, attach popular topic labels for discovery and preserve original contributors and commits to borrow credibility. That motive is plausible but not established by the scan.
The practical warning is clear even without knowing the operators: a familiar project name and realistic history do not authenticate a download. Developers should compare repository ownership and canonical links, inspect recent README-only changes, and scan downloaded content rather than only its URL. GitHub’s response to the reported 10,000-project list was not included in the supplied account.
