Apparently there’s a bunch of projects getting hit with this, fairly obscure ones though. Project gets forked, suddenly get a pile of stars more than the original, and then there’s a curl-bash pipe inserted into it that runs some ransomeware that encrypts ~/Documents.
About a dozen other projects linked in here from another developer (excuse the Reddit link): https://old.reddit.com/r/golang/comments/1jbzuot/someone_copied_our_github_project_made_it_look/
Uhhhhh, there’s plenty of that being used. From the ground up. Security scanning out the wazzzz. Those are pattern-based scanners though, and this probably wouldn’t be detected because it’s a blob of binary junk with a script inside. GitHub should honestly put something on their storage backends to warn users, but that’s a whole ball of wax people probably don’t want to get into.