Someone stole WardenOne and used it to hand people malware

In August 2026 my privacy extension was republished under someone else's name, with every download link pointed at a trojan. Here is exactly what happened.

Written 14 August 2026 by Iri 💜

💜 What happened

On 9 August 2026 I found my project on a GitHub account called ajpc6338, at github.com/ajpc6338/WardenOne. Not forked — forking is fine, that is what open source is for, and it would have said so right at the top. This was uploaded as though they had written it.

They had not touched much. They did not need to. They changed the links.

Every download button, every support link, and the line telling you where the official project lives — all of it now pointed at a website they controlled, ajpc6338.github.io, which their README called "the official repository" for my project. My release file was deleted and replaced with one called Warden-One-1.1.zip. There has never been a version 1.1 of WardenOne. I was on 1.0.0.

They also deleted my issue templates. That detail is the one that still bothers me. Those templates are how someone using a security tool tells the person who wrote it that something is wrong. Removing them meant that if the thing they were handing out hurt someone, that person had no way back to me.

💜 What the download actually was

It was not my extension with something added. It was not my extension at all.

Inside the zip: a .bat file that launched a Windows executable called exbin.exe, alongside an obfuscated script hidden in a file named certs.txt — named to look like something boring and technical so nobody would open it.

A loader and a browser credential stealer. You can read the VirusTotal report yourself — I would rather you checked than took my word for it.

I want to be plain about why this one stings. WardenOne asks for broad browser permissions. It has to, to do its job — it reads requests to block trackers, it watches pages to stop phishing. I documented every single one of those permissions on its own page, because asking for that much access means owing people an explanation.

Someone took the trust that came with that and used it to hand people a password stealer. They used a tool built to protect people as the bait.

💜 How I proved it was mine

This part is oddly reassuring, and it is the reason I want other developers to read this.

They kept my commit history. All of it. Sixty-two commits, and fifty-nine of them still had my name on them. Only three were theirs — the three where they deleted my release, added their file, and rewrote the README.

Better than that: the very first commit in their copy was d51cbec, dated 26 July 2026, authored by me. Byte for byte the same hash as the first commit in mine.

A git commit hash is a fingerprint of the file contents, the history behind it, the author, and the timestamp. Two people cannot independently arrive at the same one. It is not "this looks similar to my work" — it is arithmetic. That single line of hex was the whole case.

If you ever have to prove something is yours, your git history is the strongest evidence you have, and it is already sitting there.

💜 The part where I was in the wrong too

I could leave this bit out. I would rather not.

When I checked, I found my repository had no copyright notice anywhere in it. The licence file was the stock GPL template with the placeholders never filled in — <year>, <name of author>, exactly as it ships. Not one source file named me as the author.

So when people asked whether my name had been stripped out, the honest answer was no. There was nothing there to strip. I had published ninety-six files of work and never once written down that it was mine.

Two other things I have to be fair about, because a complaint that overstates is easier to dismiss than one that concedes:

• They did not remove the licence. The GPL text was sitting there, complete and unaltered. I checked before I claimed otherwise.
• Redistributing my work is allowed. That is what GPLv3 is for. Anyone may take WardenOne, change it, even sell it. That was never my complaint.

My complaint was narrower and, I think, harder to argue with: GPLv3 section 5(a) says a modified version must carry a prominent notice saying it was changed, and when. Theirs carried none, while calling their own website "the official repository" for my project. And the licence gives nobody the right to use the name of the work to misrepresent where it came from.

I fixed my side the same day. Ninety-six files now carry a copyright header naming me, the licence, and the address this project actually lives at, plus a NOTICE file. Any copy made from here either keeps those or visibly tears them out.

💜 What I did

• Wrote down every fact I could verify, and separately every claim I could not — so nothing I said could be knocked down later.
• Took a full mirror clone of their repository before anything could be deleted, and archived the site.
• Reported it to GitHub, both as copyright infringement and as impersonation. Those are two different processes and I nearly assumed one covered both.
• Reported the download to Google Safe Browsing and VirusTotal, which matters more than the copyright side — that is what stops the next person getting infected.
• Put a warning at the top of my README while it was still live.

GitHub has since removed the ajpc6338 account, and ajpc6338.github.io no longer resolves.

I am naming the account rather than the person, deliberately. I know what the account did — it is all recorded above, and every bit of it can be checked. I do not know who was behind it, and I am not going to guess.

💜 If this happens to you

I was not ready for this. I had never considered it. So, the short list I wish I had had:

• Put your name in your files today. Not the licence — the licence is a template until you fill it in. Your actual name, in the actual source. It takes an hour and you will never think about it again.
• Save the evidence before you report anything. Mirror clone, archive the page, write down the hashes. The moment someone realises they are caught, it disappears.
• Check the download, not just the code. I nearly reported this as a licensing problem and stopped there. The code was barely touched — the danger was entirely in the file the site was serving, and I would have missed it.
• Say the things that weaken your case out loud. It costs you nothing and it is the reason people believe the rest.
• Report the malware first, the copyright second. One of those protects people. The other protects you. Mine was not the urgent one.

💜 Where WardenOne actually lives

I am one person. I am not a company and I do not have a team, and honestly this whole thing knocked me sideways for a few days. But everything I make is open source precisely so that you never have to take my word for anything — including this page. All of it is checkable, and I would rather you checked.

Thank you for reading. Take care of yourself 💜

— Iri