PSA: Fake GitHub AI tool repos use fake commits and hidden download redirects
Justify_87 · reddit · 2026-10-27
Reddit user Justify87 warns about deceptive GitHub repos targeting AI tool seekers, especially ComfyUI custom nodes. Red flags found in one suspicious repo: automated meaningless commits, dozens of claimed features with almost no real code, Base64-encoded HTML redirecting to an unrelated download site, instructions to bypass SmartScreen and whitelist antivirus, and multiple unrelated repos funneling to the same download domain.
The repo was reported to GitHub; its name is withheld to avoid giving it exposure. Installing a custom node runs Python with full system access — stars, READMEs, and commit frequency are not proof of trustworthiness.
Useful checks: VirusTotal (hashes/domains), urlscan.io (redirects), ChatGPT to review source and commit history, and GitHub's abuse report. Avoid uploading private files to public scanners. An attached infographic lays out red flags, verification steps, and what to do if you already ran something suspicious.
More from coding & agent
- 7 open-source repos turn images into Three.js scenes and video motion into 3D animation — Promptmethus · 2026-10-27
- Claude runs 32 hours straight building a game with 15-27 parallel subagents — Promptmethus · 2026-10-27
- From pest control to selling OpenClaw agents to roofers in nine months — heyneighbor · 2026-10-27
- Anthropic's Official Support Skill Promised Refunds It Never Gave in 4 of 5 Runs — InterestingCarrot997 · 2026-10-27
- Cursor's new Agent SDK copies eve.dev conventions, signaling an emerging standard for agentic development — cramforce · 2026-10-27
- davidfowl claps back at theo: too many hand-merged PRs means you work with people, not agents — rakyll · 2026-10-27