security-awareness-malware-identification

Imported from reason-machines/security-skills (skills/security-awareness-malware-identification/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill security-awareness-malware-identification. Copyright stays with the author.

---
name: security-awareness-malware-identification
description: Identify and analyze potentially malicious software distribution repositories
triggers:
  - how do I identify malware distribution repos
  - detect fake antivirus cracks
  - recognize malicious GitHub projects
  - identify software piracy scams
  - spot credential stealing repositories
  - analyze suspicious download links
---

# Security Awareness: Malware Distribution Detection

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ CRITICAL WARNING

**This repository is a malware distribution vector.** Projects claiming to offer "cracked" or "pre-activated" commercial security software are:

1. **Illegal** - Violate copyright and software licensing laws
2. **Malicious** - Distribute trojans, ransomware, or credential stealers
3. **Deceptive** - Use fake engagement metrics (stars, topics) to appear legitimate

## What This "Project" Actually Is

This is NOT a legitimate open source project. Red flags include:

- **Crack/Keygen claims**: No legitimate project offers license bypasses
- **Missing README**: No actual documentation or source code
- **Suspicious topics**: Mix of security terms with "defender-bypass" and "thread-hijacking"
- **Artificial engagement**: Suspicious star velocity (3 stars/day on new repo)
- **No license assertion**: Avoiding legal accountability
- **Future date**: Created timestamp shows 2026 (likely system manipulation)

## How to Identify Malware Distribution Repos

### Pattern Recognition

```go
// Common malware repo indicators
type MalwareIndicators struct {
    HasCrackKeywords    bool   // "crack", "keygen", "pre-activated"
    MissingSourceCode   bool   // No actual implementation
    SuspiciousTopics    []string // Security bypass terms
    ArtificialStars     bool   // Unusual star velocity
    NoLicense           bool   // "NOASSERTION" or missing
    DownloadLinks       bool   // External file hosting
}

func AnalyzeRepo(repo Repository) bool {
    indicators := MalwareIndicators{
        HasCrackKeywords: containsKeywords(repo.Description, 
            []string{"crack", "keygen", "pre-activated", "loader"}),
        MissingSourceCode: len(repo.SourceFiles) == 0,
        SuspiciousTopics: findSuspiciousTopics(repo.Topics),
        NoLicense: repo.License == "NOASSERTION",
    }
    
    riskScore := calculateRisk(indicators)
    return riskScore > MALWARE_THRESHOLD
}

Detection Checklist

package main

import (
    "strings"
    "regexp"
)

// Malware distribution red flags
var RedFlags = []string{
    "crack", "keygen", "loader", "activator",
    "pre-activated", "full version", "license key",
    "bypass", "patch", "serial",
}

func IsSuspiciousRepo(description, readme string, topics []string) bool {
    score := 0
    
    // Check description for crack keywords
    desc := strings.ToLower(description)
    for _, flag := range RedFlags {
        if strings.Contains(desc, flag) {
            score += 3
        }
    }
    
    // Empty or missing README
    if len(readme) < 100 {
        score += 2
    }
    
    // Security bypass topics
    bypassTopics := []string{"defender-bypass", "exploit-mitigation", "thread-hijacking"}
    for _, topic := range topics {
        for _, bypass := range bypassTopics {
            if topic == bypass {
                score += 2
            }
        }
    }
    
    return score >= 5
}

Safe Alternatives

For Antivirus Software

// Legitimate antivirus options
type SecuritySoftware struct {
    Name        string
    FreeTier    bool
    OpenSource  bool
    URL         string
}

var LegitimateOptions = []SecuritySoftware{
    {Name: "Windows Defender", FreeTier: true, OpenSource: false, URL: "built-in"},
    {Name: "ClamAV", FreeTier: true, OpenSource: true, URL: "https://www.clamav.net/"},
    {Name: "Bitdefender Free", FreeTier: true, OpenSource: false, URL: "https://www.bitdefender.com/"},
}

For Security Research

If you need legitimate security tools:

# Use official package managers
# Debian/Ubuntu
sudo apt install clamav clamav-daemon

# macOS
brew install clamav

# Windows
winget install ClamAV.ClamAV

Reporting Malicious Repositories

GitHub Reporting

# Report via GitHub CLI
gh api repos/OWNER/REPO/reports \
  -X POST \
  -f reason='malware distribution' \
  -f description='Repository distributing cracked security software'

# Or use web interface at:
# https://github.com/contact/report-content

Automated Detection Script

package main

import (
    "context"
    "os"
    "github.com/google/go-github/v50/github"
    "golang.org/x/oauth2"
)

func ScanRepositories(ctx context.Context, query string) error {
    ts := oauth2.StaticTokenSource(
        &oauth2.Token{AccessToken: os.Getenv("GITHUB_TOKEN")},
    )
    tc := oauth2.NewClient(ctx, ts)
    client := github.NewClient(tc)
    
    opts := &github.SearchOptions{
        ListOptions: github.ListOptions{PerPage: 10},
    }
    
    results, _, err := client.Search.Repositories(ctx, query, opts)
    if err != nil {
        return err
    }
    
    for _, repo := range results.Repositories {
        if isMalwareDistribution(repo) {
            logSuspiciousRepo(repo)
        }
    }
    
    return nil
}

func isMalwareDistribution(repo *github.Repository) bool {
    description := strings.ToLower(*repo.Description)
    
    // Check for crack/keygen keywords
    if strings.Contains(description, "crack") || 
       strings.Contains(description, "keygen") ||
       strings.Contains(description, "pre-activated") {
        return true
    }
    
    return false
}

Educational Purpose

Use this knowledge to:

1. Protect users: Warn about malware distribution
2. Train models: Identify malicious patterns
3. Improve security: Report and remove threats
4. Educate developers: Recognize social engineering

Best Practices

// Security verification workflow
func VerifyDownloadSafety(repoURL string) error {
    checks := []SecurityCheck{
        verifyOfficialSource,
        checkCodeSignature,
        scanWithAntivirus,
        reviewSourceCode,
        checkReputationScore,
    }
    
    for _, check := range checks {
        if err := check(repoURL); err != nil {
            return fmt.Errorf("security check failed: %w", err)
        }
    }
    
    return nil
}

Safe Software Acquisition

1. Download only from official vendor websites
2. Verify digital signatures
3. Use package managers when possible
4. Check code signatures and hashes
5. Never disable antivirus to install software

DO NOT

• ❌ Download or execute files from this repository
• ❌ Share or promote crack/keygen repositories
• ❌ Disable security software to run suspicious files
• ❌ Trust repositories with artificial engagement metrics

DO

• ✅ Report malicious repositories to GitHub
• ✅ Use official software sources
• ✅ Educate others about these threats
• ✅ Use legitimate free or open source alternatives

Resources

• GitHub Security Policies
• OWASP Malware Analysis
• VirusTotal - Scan suspicious files
• URLScan.io - Analyze suspicious URLs

This skill is for educational and defensive security purposes only.