One of the researchers, El Yadmani Soufian, who is also a security researcher at Darktrace, was kind enough to provide BleepingComputer with additional examples not included in the technical report, which are given below:

PowerShell PoC containing a binary encoded in base64 flagged as malicious in Virus Total.


Python PoC containing a one-liner that decodes a base64-encoded payload flagged as malicious on Virus Total.


Fake BlueKeep exploit containing an executable that is flagged by most antivirus engines as malicious, and identified as Cobalt Strike.


A script hiding inside fake PoC with inactive malicious components that could cause damage if its author wishes so.


How to stay safe

Blindly trusting a repository on GitHub from an unverified source would be a bad idea since the content is not moderated, so it falls on the users to review it before using it.

Software testers are advised to carefully scrutinize the PoCs they download and run as many checks as possible before executing them.

Soufian believes that all testers should follow these three steps:

  1. Read carefully the code you are about to run on your or your customer's network.
  2. If the code is too obfuscated and needs too much time to analyze manually, sandbox it in an environment (ex: an isolated Virtual Machine) and check your network for any suspicious traffic.
  3. Use open-source intelligence tools like VirusTotal to analyze binaries.

The researchers have reported all the malicious repositories they discovered to GitHub, but it will take some time until all of them are reviewed and removed, so many still remain available to the public.

As Soufian explained, their study aims not just to serve as a one-time cleaning action on GitHub but to act as a trigger to develop an automated solution that could be used to flag malicious instructions in the uploaded code.

This is the first version of the team's research and they are working on improving their detector. Currently, the the detection tool misses code with stronger obfuscation.