I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.
Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending.
GitHub announced this a while back:
https://github.blog/changelog/2026-07-28-npm-publish-time-ma...
"A while back" -- One week ago.
I am curious if they are still implementing the process or if this particular attacker already figured out a way around it.
Ah, I see your problem there
> This requirement will be progressively enforced over time.
> I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.
Maybe that's the idea. Regards, the <insert your favourite 3 letter agency here>