How do you report malware hosted as GitHub attachments?

[olihough86]

Select Topic Area

Question

Body

I have a bunch of direct links to malware payloads hosted on Github for an active malware campaign, I only have the links, I do not know who uploaded them, which issue or whatever they were attached to, I only have the direct links to the files for example:

hxxps://github.com/user-attachments/files/[numbers]/[filename]

There appears to be no way to open a ticket for abuse/trust & safety, so how can these be delt with?

This appears to be a long standing issue as I've already seen the same question asked before (June 2024) and it was closed and locked without an answer, also the link they gave as an example is still live :/

[yeenrux]

[olihough86]

Thanks for the answer though the form has a required field

Please provide the username, repository, or GitHub Pages URL you wish to report.*

This needs to be one of those (it's validated on entry) which I do not have.

[olihough86]

The form they have is fine, all they need to do is remove the strong validation on the required field for a link to a repo etc so it can accommodate edge cases