In the last month I discovered a couple of repositories posing as legit FOSS audio plugins but are trying to spread some likely Lua malware.
The legit audio plugins repos targeted were, until now:
https://github.com/SpotlightKid/waxman
https://github.com/jurihock/robotone
The campaign is usually done in 3 steps:
A copy of the repo is created on Github without forking the original one by a newly created user
The new commits added to the fake repo are usually README updates with some AI crap, resembling/reinterpreting the original plugin's README. It's done multiple times over several days so the repo gets among the recently active repos.
A few days later a zip file is uploaded in the Releases section. It contains luajit.exe for Windows, along with lua51.dll, a .txt file containing obfuscated Lua code and a .bat or .cmd file to execute the code
The fake repos are down now.
It doesn't seems a well thought campaign, their way of trying deceive the user into running their program is highly suspicious to the mildly security aware audio user and it seem to target only Windows for now.
Still, I found it quite concerning, just wanted to spread the word.
