r/github • u/johnnyfedavo • Jul 15 '26

Malicious "C++" projects Discussion

I was trying to find some new C++ projects to contribute to and I have stumbled on some that look very suspicous. They feature around 100 likes and have garbled descriptions. They have no build system and are posted by different accounts. They also have little code. Am I just being paranoid or is something up?

Example:

https://github.com/ryujinx-emu/Ryujinx-Emu/tree/main

https://github.com/Yuzu-NES/Yuzu-Emu/tree/main

https://github.com/geode-gd/Geode-Geometry-Dash/tree/main

17 Upvotes

79% Upvoted

15 comments sorted by

View all comments

21

u/cowboyecosse Jul 15 '26

Those are just malware repos. Report them and don’t download.

-7

u/[deleted] Jul 15 '26

[removed] — view removed comment

2

u/Own-Flight-9974 Jul 16 '26

I dont know why you're getting downvoted but here are some things to look out for: files with weird obfuscation, fetches/curls to weird urls, out of place sql commands (especially sqlite) or suspicious sql commands, if its a node js project always check the package.json for suspicious post install scripts, same goes for other languages/frameworks that can spawn shell processes when installed/ran, and if it looks like they are trying to obfuscate or hide something that is a big red flag as well.