On August 31st, I received an email from a customer informing me that they had discovered an imitation of my data wrangling software on Github. While I won't link to it, here is a screenshot:
It was using our product name and logo without permission. I reported it to Github as an imitation on the same day. I received this reply:
A colleague scanned the Mac .dmg file from the repository using virustotal.com and found numerous malware warnings:
Using Isobuster, they discovered that the background image of the .dmg had also been altered:
The new image instructs downloaders to disregard any warnings about the malware!
I reported this additional information on September 10th.
As of September 23rd, I have not received any response from Github support beyond the initial automated email. 23 days without a reply. This is unacceptable. Do better, Github.
I'm unsure of my next course of action. Should I issue a DMCA takedown request to Github?
Realistically, the only individuals likely to download the .dmg are those attempting to avoid paying for a license for Easy Data Transform. I don't have much sympathy for them if their computers are compromised. However, I strongly dislike malicious actors exploiting my hard work.
P.S. Always download software directly from the vendor whenever possible.
