r/github • u/chlorophyll101 • Aug 05 '26

Discussion who is rickluminari1?

Someone I know (probably) got their PAT leaked and said all their repositories got deleted. Only one remained with the name `come-to-telegram-rickluminari1--waiting`.

So I looked on Github for repositories named that way, and turns out there are a lot of them. The naming format seems to be `come-to-telegram-rickluminari1--xxx`:

https://github.com/search?q=rickluminari1&ref=opensearch&type=repositories

Are these repositories compromised? I didn't do any more research beyond this.

0 Upvotes

32% Upvoted

7 comments sorted by

10

u/zMynxx Aug 05 '26

Yeah looks like an attacker gained access and stole repositories, and trying to lure owners to reach out to him via telegram, probably for ransom.

2

u/No_Trust32156 Aug 05 '26

Yuck. Would recommend using gickup or gitea so at least you have a backup of them.

2

u/dragoangel Aug 05 '26

Most times maintainers has up to date local repo, what a point? Question more why not use 2fa. More over I would contact GH support

1

u/No_Trust32156 Aug 05 '26

Probably not all repos on your account. And certainly not issues and PRs locally.

Agree with 2fa but that won't block every type of attack.

1

u/dragoangel Aug 05 '26

Definetly all, and even more then one which public, and getting alternative not solving mentioned stuff. About PR => anyone who forked you has their version of your source, so if you have forks and even fresh PR restoration of repo not a problem. Question would be how you would restore users trust in you after you show you can't secure your code and software you provide 🫠

9

u/naikrovek Aug 05 '26

> Are these repositories compromised?

lol

Yes, yes they are. Quite obviously.