GitHub Developer Scam OSINT Report
OSINT page for GitHub developer scam risk, repository deletion, backdoor bot tools, VPS access danger, SSH key exposure, and Soldrift devbeast5775 public security warning context.
GitHub reputation is not an audit
A GitHub account, follower count, repository count, README, star count, or public demo does not prove that wallet-connected software is safe. Scam or backdoor risk can still exist in deleted repositories, renamed accounts, private repos, release binaries, minified files, or code that behaves differently after deployment.
Repository and account red flags
Red flags include sudden repository deletion, 404 after reports, renamed projects, copied README content, closed-source binaries, hidden install scripts, external webhooks, Telegram-controlled support, private deployment instructions, suspicious .env handling, and requests to access a customer VPS directly.
VPS and SSH exposure
When a developer has root access to a VPS, they may be able to read source code, copy keys, add SSH authorized_keys entries, install systemd services, modify PM2 processes, alter cron jobs, add reverse shells, or hide logging. Remove unknown SSH keys and rotate passwords after any untrusted developer access.
OSINT preservation
Preserve public evidence with UTC timestamps: repository URLs, commits, issues, profile screenshots, README text, release files, Telegram handles, Solscan links, transaction hashes, archive snapshots, and deployment logs. Do not publish private keys, seed phrases, unrelated personal data, or unsupported personal claims.
Public safety and correction notice
This page is a search-focused public safety page connected to the main OSINT report. It is intended for prevention, security awareness, and evidence preservation. It does not publish private keys, seed phrases, unrelated private data, or unsupported personal information. Corrections should include verifiable public evidence.