security-awareness-malicious-repository-identification

Imported from reason-machines/security-skills (skills/security-awareness-malicious-repository-identification/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill security-awareness-malicious-repository-identification. Copyright stays with the author.

---
name: security-awareness-malicious-repository-identification
description: Identify and analyze potentially malicious software distribution repositories masquerading as legitimate security tools
triggers:
  - how do I identify fake security software repositories
  - detect malicious software distribution on github
  - recognize cracked software distribution patterns
  - identify malware disguised as security tools
  - analyze suspicious repository indicators
  - spot fake antivirus crack repositories
  - evaluate repository security red flags
  - detect software piracy malware vectors
---

# Security Awareness: Malicious Repository Identification

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ WARNING: This Repository is Malicious

The repository "MistDuckCount/Bitdefender-Total-Security-Crack-2026" is a **malicious software distribution vector** disguised as legitimate security software. This skill teaches security awareness and identification of such threats.

## What This Is

This is **NOT** a legitimate Bitdefender distribution. It is a social engineering attack using:

- **Fake software cracks** promising pre-activated licenses
- **Malware distribution** disguised as security software
- **Repository manipulation** with artificial stars and engagement
- **SEO poisoning** using security-related keywords

## Red Flags Identified

### 1. **Contradictory Purpose**
- Claims to be "antivirus protection" while offering "Defender bypass"
- Security software should never bypass security mechanisms

### 2. **Illegal Activity Indicators**

Description keywords:

• "Crack"
• "Keygen Loader"
• "Pre-Activated"
• "Full Version License Key"

### 3. **Suspicious Repository Metadata**
```yaml
Stars: 59 (4 stars/day)  # Artificially inflated
Forks: 0                  # No legitimate development
Open Issues: 0            # No community interaction
No README                 # No documentation
License: NOASSERTION      # Avoiding legal scrutiny

4. Malicious Topics

Topics include:
- "defender-bypass"       # Explicit security evasion
- "thread-hijacking"      # Attack technique
- "exploit-mitigation"    # Misused security term

5. Language Mismatch

• Claims to be written in Go
• Bitdefender is not a Go project
• Likely contains compiled malware binaries

How to Identify Similar Threats

Pattern Recognition

# Malicious repository detection heuristics
def analyze_repository_risk(repo_data):
    risk_score = 0
    red_flags = []
    
    # Check for crack/keygen keywords
    suspicious_keywords = [
        'crack', 'keygen', 'loader', 'pre-activated',
        'full version', 'license key', 'bypass'
    ]
    
    description = repo_data.get('description', '').lower()
    for keyword in suspicious_keywords:
        if keyword in description:
            risk_score += 10
            red_flags.append(f"Suspicious keyword: {keyword}")
    
    # Check star/fork ratio
    stars = repo_data.get('stars', 0)
    forks = repo_data.get('forks', 0)
    
    if stars > 20 and forks == 0:
        risk_score += 15
        red_flags.append("Unusual star/fork ratio (likely fake stars)")
    
    # Check for missing README
    if not repo_data.get('has_readme', True):
        risk_score += 5
        red_flags.append("No README provided")
    
    # Check for contradictory security claims
    if 'antivirus' in description and 'bypass' in description:
        risk_score += 20
        red_flags.append("Contradictory security claims")
    
    # Assess risk level
    if risk_score >= 30:
        return "HIGH RISK - LIKELY MALICIOUS", red_flags
    elif risk_score >= 15:
        return "MEDIUM RISK - INVESTIGATE FURTHER", red_flags
    else:
        return "LOW RISK", red_flags

# Example usage
repo = {
    'description': 'Bitdefender Total Security Crack Keygen Loader Defender Bypass',
    'stars': 59,
    'forks': 0,
    'has_readme': False
}

risk_level, flags = analyze_repository_risk(repo)
print(f"Risk Level: {risk_level}")
for flag in flags:
    print(f"  - {flag}")

OSINT Investigation

# Check repository metadata
curl -H "Authorization: token ${GITHUB_TOKEN}" \
  https://api.github.com/repos/MistDuckCount/Bitdefender-Total-Security-Crack-2026

# Analyze commit history (if any)
git log --all --oneline --graph

# Check for binary files (common in malware repos)
find . -type f -exec file {} \; | grep -i "executable\|PE32\|ELF"

# Scan with multiple AV engines (VirusTotal API)
curl --request POST \
  --url https://www.virustotal.com/api/v3/files \
  --header "x-apikey: ${VIRUSTOTAL_API_KEY}" \
  --form file=@suspicious_file.exe

Safe Alternatives

Legitimate Bitdefender Acquisition

✅ Official sources ONLY:
- https://www.bitdefender.com/
- Authorized resellers listed on official site
- Legitimate software vendors (Amazon, Newegg, etc.)

❌ NEVER download from:
- GitHub repositories offering "cracks"
- File sharing sites
- "Free download" websites
- Social media direct links

Verification Process

// Example: Verify software authenticity
package main

import (
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "io"
    "os"
)

func verifyFileHash(filepath string, expectedHash string) (bool, error) {
    file, err := os.Open(filepath)
    if err != nil {
        return false, err
    }
    defer file.Close()
    
    hash := sha256.New()
    if _, err := io.Copy(hash, file); err != nil {
        return false, err
    }
    
    computedHash := hex.EncodeToString(hash.Sum(nil))
    
    fmt.Printf("Expected:  %s\n", expectedHash)
    fmt.Printf("Computed:  %s\n", computedHash)
    
    return computedHash == expectedHash, nil
}

func main() {
    // Always verify hashes from official vendor site
    officialHash := os.Getenv("OFFICIAL_BITDEFENDER_HASH")
    downloadPath := "./bitdefender_installer.exe"
    
    verified, err := verifyFileHash(downloadPath, officialHash)
    if err != nil {
        fmt.Printf("Error: %v\n", err)
        return
    }
    
    if verified {
        fmt.Println("✅ File verified - safe to install")
    } else {
        fmt.Println("❌ VERIFICATION FAILED - DO NOT INSTALL")
    }
}

Reporting Malicious Repositories

GitHub Abuse Report

# Report via GitHub web interface:
# 1. Navigate to repository
# 2. Click "..." menu
# 3. Select "Report repository"
# 4. Choose: "Distributes malware"

# Or use GitHub API (requires authentication)
curl -X POST \
  -H "Authorization: token ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/OWNER/REPO/vulnerability-alerts

Additional Reporting Channels

1. Bitdefender official abuse contact
   abuse@bitdefender.com

2. Google Safe Browsing
   https://safebrowsing.google.com/safebrowsing/report_badware/

3. VirusTotal community
   Upload sample and flag as malicious

4. CERT/CC
   https://www.cisa.gov/report

Educational Takeaways

For Developers

1. Never use pirated software - especially security tools
2. Verify digital signatures of all downloaded executables
3. Use official package managers when possible
4. Check repository authenticity before cloning/downloading
5. Enable 2FA to prevent account compromise for malware distribution

For Security Researchers

# Automated malware repository scanner
import requests
import os

def scan_github_for_malware_patterns(search_term):
    headers = {
        'Authorization': f'token {os.getenv("GITHUB_TOKEN")}',
        'Accept': 'application/vnd.github.v3+json'
    }
    
    url = f'https://api.github.com/search/repositories?q={search_term}+crack+keygen'
    
    response = requests.get(url, headers=headers)
    repos = response.json().get('items', [])
    
    for repo in repos:
        print(f"\n🚨 Suspicious: {repo['full_name']}")
        print(f"   Stars: {repo['stargazers_count']}")
        print(f"   Description: {repo['description'][:100]}...")
        print(f"   URL: {repo['html_url']}")

# Example usage
scan_github_for_malware_patterns('antivirus')

Conclusion

This repository represents a clear and present security threat. Do not download, clone, or execute any code from it. Use this skill to identify similar threats and protect yourself and others from malware distribution campaigns.

Remember: Legitimate security software is never distributed through "crack" repositories.