GitHub Healthcheck: catching the clones shipping malware under your name
GitHub Healthcheck scans your GitHub account and repos for the malware-clone campaign, and alerts you the moment someone clones your work.
A while back I read a writeup that genuinely rattled me. Attackers had been cloning real, popular repositories — full commit history, contributor list, README, the works — under throwaway accounts. Not forks. Verbatim copies that read as original. They changed exactly one thing: a single Update README.md commit adding a download link to a password-protected ZIP. Inside the ZIP, a LuaJIT loader that pulls SmartLoader and then StealC.
The clever part is what makes it nasty. The download link scans clean on VirusTotal. Only the extracted ZIP trips antivirus, and it's password-protected so the scanners can't even peek. An estimated ~10,000 of these repos sat undetected for over a year.
What stuck with me wasn't the malware. It's that the clone looks more legit than your actual project at a glance — inherited history, real contributors, a polished README. And AI coding agents happily recommend them. So I built GitHub Healthcheck.
What GitHub Healthcheck actually does
You sign in with GitHub and get a security report on three things: your account, your repos, and any clones of your work that are out there impersonating you.
It scores every repo you own against the campaign's indicators. It searches GitHub for malicious verbatim copies of your repos. It hands the account a 0–100 trust grade — age, 2FA, clustered activity — and a band from safe up to critical. And because the attack is ongoing, a daily background scan emails you the moment a new clone of your work shows up. You can also paste in any repo or account to vet it before you trust it, which is the use I reach for most when an agent suggests some repo I've never heard of.
The detection engine isn't fancy ML. It's the boring tells the original researcher used, encoded as rules: README references a binary, a shields badge that links to an archive, password-protected language, a URL shortener or anon file host, "free / cracked / full version" lures, a release asset literally named loader.exe or lua51.dll. The single clearest signal is almost embarrassing — the latest commit changed only the README. That one heuristic does a lot of work. Dumb beats clever here.
The wall I hit
Clone detection is where I lost a weekend. Searching GitHub for copies of your code sounds simple until you actually do it. The rate budget is tiny, code search is fuzzy, and the obvious matches are your own forks and legitimate mirrors. My first pass flagged everything and meant nothing.
The fix was to stop being greedy. I cap the search — top-10 most-starred repos, a handful of candidates each — and lean hard on the "verbatim but not a fork" shape, because that combination is the actual fingerprint. Then the daily cron diffs new results against a stored baseline of known clones, so you only ever get emailed the genuinely new one. Nobody wants the same alert every morning until they mute it.
The design call I'm proudest of
One rule, decided on day one and never bent: the app never touches the payload. It only ever calls api.github.com. It reads README and link text — it never downloads an archive, never executes anything, and never fetches a user-supplied URL. Zero SSRF surface.
That's a real constraint, not a footnote. A "security scanner" that fetches attacker-controlled URLs is just a new attack surface wearing a badge. So the whole engine is pure text analysis, fully unit-tested, with no network calls in the hot path. Sessions are server-side, the GitHub token is AES-GCM encrypted at rest in D1, and the browser cookie only holds an opaque id. OAuth asks for read:user and nothing more unless you opt into private repos.
The whole thing is TypeScript end-to-end on Cloudflare — Workers, D1, a Cron Trigger, and Cloudflare Email. One platform for auth, data, scheduling, and the alert mail. No glue servers.
What surprised me
I expected to be defending against scary code. Instead the entire campaign hinges on one social move: make a fake look original. The malware is almost an afterthought. The defense isn't smarter analysis — it's spotting the seam where the disguise is thin. A year of invisibility, undone by "the last commit only edited the README."
If you ship on GitHub, run GitHub Healthcheck on your account and see if anyone's cloned your work yet. It's open source (beardwhocodes/github-healthcheck) if you'd rather read the rules than trust me.
If it catches something, come tell me on X. Now copy Josh.