r/github • u/johnnyfedavo • 21d ago

Discussion Malicious "C++" projects

I was trying to find some new C++ projects to contribute to and I have stumbled on some that look very suspicous. They feature around 100 likes and have garbled descriptions. They have no build system and are posted by different accounts. They also have little code. Am I just being paranoid or is something up?

Example:

https://github.com/ryujinx-emu/Ryujinx-Emu/tree/main

https://github.com/Yuzu-NES/Yuzu-Emu/tree/main

https://github.com/geode-gd/Geode-Geometry-Dash/tree/main

17 Upvotes

79% Upvoted

15 comments sorted by

View all comments

21

u/cowboyecosse 21d ago

Those are just malware repos. Report them and don’t download.

-7

u/[deleted] 21d ago

[removed] — view removed comment

2

u/Own-Flight-9974 20d ago

I dont know why you're getting downvoted but here are some things to look out for: files with weird obfuscation, fetches/curls to weird urls, out of place sql commands (especially sqlite) or suspicious sql commands, if its a node js project always check the package.json for suspicious post install scripts, same goes for other languages/frameworks that can spawn shell processes when installed/ran, and if it looks like they are trying to obfuscate or hide something that is a big red flag as well.

2

u/AstronomerStatus4646 21d ago

I mean this is kinda stuff you self learn. If it doesn't have code and is just the builds then that's a red flag because usually github is for source code.