submitted 1 day ago by glibg10b@lemmy.zip to c/opensource@lemmy.ml

11 comments fedilink hide all child comments

These scammers copy the text from new issues verbatim, and paste them in a new issue in a "support" repo. They tag the original author so they get notified.

They then use GitHub Actions to reply with a phishing link and email.

This particular repo has been up for a week and has done this to 113 people.

The link leads to a page that impersonates GitHub support. Every link on that page leads to a crypto scam.

If you stumble across such a repository, please report it. You can report this one here.

top 11 comments

sorted by: hot top controversial new old

[-] hperrin@lemmy.ca 42 points 1 day ago

Curse you, Team Rocket.

[-] XTL@sopuli.xyz 29 points 1 day ago

As if there needed to be more reasons to https://sfconservancy.org/GiveUpGitHub/

[-] digdilem@lemmy.ml 10 points 1 day ago

Surely this will re-occur anywhere there is sufficient footfall?

[-] glibg10b@lemmy.zip 8 points 1 day ago

GitHub's reporting functions are limited. For example, it's not possible to report the issue or the reply from GitHub Actions. And the form for reporting the whole repository is somewhat broken and annoying to use

[-] kyub@discuss.tchncs.de 10 points 1 day ago

Yes. It always pains me when I see how tons of open source projects will not leave Github because of the network effect. Yes, it might be inconvenient... even punishing... but it needs to happen, especially after Microsoft bought Github. The ONLY way to counter the network effect (and contribute to meaningful change over time) is by NOT being part of the network effect. By remaining part of it, you're only helping Microsoft.