A honeypot repo with 1,774 stars: two filters for detecting malware and hallucinations

A honeypot with 1,774 stars

Every morning, a Telegram bot sends the author five trending GitHub repositories from trendshift.io. Under each one is a button that, when clicked, has the bot produce a README digest for quick review. The author reads this feed daily, sometimes starring projects they like.

On September 26, the feed featured a repo called "Microsoft Activation Scripts" with 1,774 stars, a tidy description, and tags. The bot presented it alongside four other projects — and it was a trap. The repository contained a single README file, and the owner's account had been created just 94 seconds before the repo itself.

The installation command looked like `iex(irm(-join"…"[-1..-99]))` — the download address was written backwards.

PowerShell first reverses the string, then downloads the script and executes it immediately. The domain can't be read by eye, and a scanner looking for links in the text won't catch it. The address pointed to a domain designed to look genuine.

Real Microsoft Activation Scripts projects do exist and also use the irm | iex installation pattern — that's exactly what the trap relied on.

Why obvious filters didn't work

The author ran a rule check against 321 repositories sent by the bot between July 15 and October 8 (314 of them are still live). The first idea was to flag "download and run immediately" installations from sites other than GitHub. But that's how 38 out of 314 legitimate projects install — including codex, opencode, as well as the rustup and uv installers. That filter would have hidden every eighth repo from the trending feed, including some of the most useful ones.

The second rule was "owner account less than 30 days old." The trap would have passed this check too: by the day it was sent, the account was already 34 days old. A throwaway account isn't defined by its age at the time of inspection, but by the gap between account creation and repository creation.

The two filters that worked

First filter (disguised installation command)

Checks the README for signs of obfuscation:

• A reversed string via `-join"…"[-1..` combined with `iex(irm(…))` using a computed address
• Base64-encoded code that gets decoded and executed immediately
• Hidden execution via `mshta`, `certutil`, `bitsadmin`, or `-WindowStyle Hidden`

Before the check runs, the text is stripped of invisible characters and PowerShell backtick escapes (like i`e`x).

Second filter (throwaway owner and absence of code)

Blocks a repository if:

• The account was created less than 30 days before the repo
• The repository contains less than 10 KB of content, or only a README and LICENSE

If GitHub doesn't respond, that's treated as "unknown," not "no code" — a network failure shouldn't end up hiding a legitimate project.

Across all 314 repositories, each signal triggered exactly once — on the fake activator. Since October 9, this check has been running inside the bot. If a repository looks like a trap, the bot drops it from the digest, replaces it with the next-ranked project, and adds a single line explaining what was hidden and why.

The second problem: AI hallucinations

The bot asks DeepSeek to summarize each repository in a single sentence in Russian. For one project whose description contained only meat.dev, the model called it "a web framework for Ruby." For a testing tool, it compared the project to Cypress, which wasn't mentioned anywhere in the source. Everything sounds plausible, and none of it is catchable by eye.

The author collected 303 real summaries and compared them against their sources. The rule is simple: every Latin-alphabet word with a capital letter or a number (Ruby, GPT-5) and every number with three or more digits, a decimal point, or a percent sign must appear in the source. If it doesn't, the bot falls back to showing the original GitHub description.

The first version of the rule rejected 9 out of 303 summaries. Four of those turned out to be different spellings of the same thing: Open-source vs. "open source," Wi-Fi vs. "WiFi," 2234 vs. "2,234." The author added comparison that ignores hyphens and spaces, and stripped thousands separators. That left 5 rejections: three genuine fabrications (Ruby, Cypress, Scratch) and two where the source didn't actually confirm the claim (NVIDIA and the 19th century). Over the next four days: 20 summaries, zero rejections.

Where to get the tools

lure-check: `python3 lure_check.py owner/repo` — returns exit code 1 for a trap, convenient for CI

ground-check: `python3 ground_check.py --source source.txt --text summary.txt`

Both tools are single-file Python scripts, standard library only, MIT-licensed, with tests built on real-world cases. The honeypot used in the tests has been defanged, with all addresses replaced.