© Valve Corporation. All rights re­served. All trade­marks are prop­erty of their re­spec­tive own­ers in the US and other coun­tries. Privacy Policy |  Legal |  Accessibility |  Steam Subscriber Agreement |  Refunds |  Cookies

© Valve Corporation. All rights re­served. All trade­marks are prop­erty of their re­spec­tive own­ers in the US and other coun­tries. Privacy Policy |  Legal |  Accessibility |  Steam Subscriber Agreement |  Refunds |  Cookies

Maintained by Epic Games, Lore is de­signed for un­prece­dented scal­a­bil­ity of both data and teams. It’s op­ti­mized for pro­jects—in­clud­ing games and en­ter­tain­ment—that com­bine code with large bi­nary as­sets, and caters for the needs of de­vel­op­ers and artists alike.

deno desk­top turns a Deno pro­ject (anything from a sin­gle TypeScript file to a Next.js app) into a self-con­tained desk­top ap­pli­ca­tion. The out­put is a re­dis­trib­utable bi­nary that bun­dles your code, the Deno run­time, and a web ren­der­ing en­gine into one bun­dle per plat­form.

Coming in Deno 2.9

deno desk­top ships in Deno v2.9.0 and is not in a sta­ble re­lease yet. To try it now, run deno up­grade ca­nary to in­stall the ca­nary build. The com­mand, con­fig­u­ra­tion keys, and TypeScript APIs may still change be­fore the fea­ture is sta­ble.

Why deno desk­top Jump to head­ing

Web tech­nol­ogy is the most widely-known UI toolkit in the world. Desktop apps built on web stacks (Electron, Tauri, Electrobun) take ad­van­tage of that, but each has trade­offs you have to live with: huge bi­na­ries, miss­ing plat­form sup­port, no JavaScript ecosys­tem, no built-in up­date story, no frame­work in­te­gra­tion.

deno desk­top is opin­ion­ated about those trade­offs:

Small by de­fault, full Node com­pat­i­bil­ity. The de­fault WebView back­end uses the op­er­at­ing sys­tem’s own we­b­view for small bi­na­ries, and you still have the en­tire npm ecosys­tem avail­able through Deno’s Node com­pat layer. Opt into the bun­dled Chromium (CEF) back­end when you need iden­ti­cal ren­der­ing across ma­cOS, Windows, and Linux.

Framework auto-de­tec­tion. Point deno desk­top at a Next.js, Astro, Fresh, Remix, Nuxt, SvelteKit, SolidStart, TanStack Start, or Vite SSR pro­ject and it runs: the pro­duc­tion server in re­lease mode, the dev server with hot re­load un­der –hmr. No code changes are re­quired to take an ex­ist­ing web pro­ject to the desk­top.

In-process bind­ings in­stead of IPC. Backend and UI com­mu­ni­ca­tion goes through in-process chan­nels, not socket-based IPC. Values are still en­coded as they cross the call bound­ary, but there is no cross-process round-trip be­tween your Deno code and the we­b­view.

Cross-compile from one ma­chine. The same ma­chine can build for ma­cOS, Windows, and Linux. Backends are down­loaded as needed, not built lo­cally.

Built-in bi­nary-diff auto-up­date. Ship a sin­gle lat­est.json man­i­fest and bs­d­iff patches; the run­time polls, ap­plies, and rolls back au­to­mat­i­cally on failed launches.

Hello, desk­top Jump to head­ing

Create a one-file desk­top app:

main.ts

Deno.serve(() => new Response(“<h1>Hello, desk­top</​h1>”, { head­ers: { “content-type”: “text/html” }, }) );

>_

deno desk­top main.ts

The com­piled bi­nary opens a win­dow pointed at a lo­cal HTTP server bound to your Deno.serve() han­dler. Run it di­rectly:

>_

./main # ma­cOS / Linux .\main.exe # Windows

Deno.serve() au­to­mat­i­cally binds to the ad­dress the we­b­view nav­i­gates to, so you do not need to pass a port or host­name. See HTTP serv­ing for de­tails.

What’s in this sec­tion Jump to head­ing

Configuration: the desk­top block in deno.json.

Backends: CEF, we­b­view, raw; how to choose.

HTTP serv­ing: Deno.serve() in­te­gra­tion and the serv­ing model.

Frameworks: Next.js, Astro, Fresh, Remix, Nuxt, SvelteKit, and oth­ers.

Windows: Deno.BrowserWindow life­cy­cle, mul­ti­ple win­dows, events.

Bindings: call­ing Deno code from the we­b­view via bind­ings.<name>().

Menus: ap­pli­ca­tion and con­text menus.

Tray and dock: sys­tem sta­tus icons and the ma­cOS dock.

Dialogs: prompt(), alert(), con­firm() as na­tive pop­ups.

Notifications: na­tive OS no­ti­fi­ca­tions via the Web Notification API.

Hot mod­ule re­place­ment: –hmr for frame­work and non-frame­work apps.

DevTools: uni­fied DevTools at­tached to both the Deno run­time and the we­b­view.

Auto-update: Deno.autoUpdate(), man­i­fests, bs­d­iff, roll­back.

Error re­port­ing: cap­tur­ing un­caught ex­cep­tions and pan­ics.

Distribution: cross-com­pi­la­tion, out­put for­mats, in­stallers.

Comparison: how deno desk­top re­lates to Electron, Tauri, Electrobun, Dioxus.

deno desk­top CLI ref­er­ence: the com­mand, its flags, and the deno.json desk­top schema.

Hyundai’s move to buy SoftBank’s re­main­ing 9.65% stake in Boston Dynamics for $325 mil­lion is not just cleanup from an old deal. It gives Hyundai full con­trol of one of the few hu­manoid ro­bot­ics com­pa­nies with real fac­tory work in sight.

Hyundai Motor Group is ex­pected to ap­prove the pur­chase on June 22, clos­ing out SoftBank’s last piece of Boston Dynamics and turn­ing the Waltham, Massachusetts ro­bot­ics com­pany into a wholly owned Hyundai busi­ness. The price is $325 mil­lion for the re­main­ing stake, ac­cord­ing to the deal terms, and it fol­lows the put op­tion SoftBank re­tained when Hyundai bought con­trol of Boston Dynamics in 2021.

You should read that as a sig­nal, not a foot­note. Hyundai paid about $880 mil­lion for an 80% stake in Boston Dynamics in the 2021 trans­ac­tion, valu­ing the com­pany at roughly $1.1 bil­lion at the time. SoftBank had bought Boston Dynamics from Alphabet in 2017, af­ter Google had ac­quired the ro­bot­ics lab in 2013. It was a strange own­er­ship path for a com­pany whose ro­bots be­came fa­mous on YouTube long be­fore they be­came ob­vi­ous com­mer­cial prod­ucts.

That part is chang­ing. At CES in Las Vegas on January 5, 2026, Hyundai and Boston Dynamics showed the elec­tric Atlas hu­manoid ro­bot in pub­lic, with the Associated Press re­port­ing that the life-sized ro­bot stood up, walked around the stage and was re­motely pi­loted for the demon­stra­tion. The use­ful de­tail was not the stage­craft. It was the de­ploy­ment plan. A pro­duc­tion ver­sion of Atlas is ex­pected to be­gin work at Hyundai’s elec­tric ve­hi­cle plant near Savannah, Georgia, by 2028.

Boston Dynamics has spent years mak­ing ro­bots that looked too good to be busi­nesses. Spot, its four-legged ro­bot, be­came the first ob­vi­ous com­mer­cial suc­cess. Atlas is the harder test be­cause hu­manoid ro­bots have to jus­tify them­selves in places where tra­di­tional au­toma­tion al­ready ex­ists. Business Insider re­ported in January that Boston Dynamics CEO Robert Playter said Atlas would need to learn new fac­tory tasks in a day or two and reach 99.9% re­li­a­bil­ity be­fore it could be truly use­ful on the floor. That’s a high bar. It’s also the right one.

Hyundai’s ad­van­tage is that it does­n’t have to imag­ine the first cus­tomer. It owns the fac­to­ries, the ve­hi­cle pro­grams and now the whole ro­bot­ics com­pany. The Verge re­ported from CES that Hyundai plans to start Atlas with parts se­quenc­ing at its Metaplant in Georgia, then move to­ward heav­ier and more com­plex op­er­a­tions by 2030. If you’re build­ing ro­bots for the phys­i­cal world, that kind of con­trolled de­ploy­ment mat­ters more than a per­fect demo video.

The sup­ply chain is part of the story too. Hyundai Mobis, the group’s com­po­nents arm, has been tied to ac­tu­a­tor pro­duc­tion for Atlas, which keeps one of the ro­bot’s most im­por­tant hard­ware sys­tems closer to Hyundai’s own in­dus­trial base. Frankly, that is the dif­fer­ence be­tween treat­ing ro­bot­ics as a side bet and treat­ing it as a man­u­fac­tur­ing ca­pa­bil­ity. A hu­manoid ro­bot is only as use­ful as the parts, ser­vice net­work and pro­duc­tion dis­ci­pline be­hind it.

The field around Boston Dynamics is no longer sleepy. Tesla has shifted part of its Fremont fac­tory story to­ward Optimus af­ter end­ing Model S and Model X pro­duc­tion, a move re­ported by Axios and The Verge ear­lier this year. Figure AI has pushed hu­manoid ro­bots into BMW fac­tory tri­als. Unitree has made lower-cost hu­manoids im­pos­si­ble to ig­nore. None of those com­pa­nies has Boston Dynamics’ long record in lo­co­mo­tion, but they don’t need to. They need to make ro­bots cheap enough, use­ful enough and re­li­able enough to win spe­cific jobs.

That is why full own­er­ship mat­ters for Hyundai. Boston Dynamics does­n’t have to beat every hu­manoid ri­val in every mar­ket. It has to make Atlas work in­side Hyundai plants first, where the tasks are known, the lay­out is con­trolled and the pay­off can be mea­sured in pro­duc­tion up­time rather than con­fer­ence ap­plause. If it works there, Hyundai gets a ro­bot­ics plat­form and a proof point at the same time.

SoftBank has moved on to a big­ger AI bet

For Masayoshi Son, the Boston Dynamics exit looks small be­side SoftBank’s cur­rent AI in­fra­struc­ture cam­paign. The Wall Street Journal re­ported in April that SoftBank is form­ing Roze AI, a new ven­ture meant to use ar­ti­fi­cial in­tel­li­gence and ro­bot­ics to build phys­i­cal in­fra­struc­ture, in­clud­ing data cen­ters. Tom’s Hardware, cit­ing the Financial Times, re­ported that Son is aim­ing for a $100 bil­lion val­u­a­tion for Roze and a pub­lic list­ing as soon as this year.

That puts the $325 mil­lion Boston Dynamics pro­ceeds in per­spec­tive. SoftBank is not walk­ing away from ro­bot­ics as an idea. It is mov­ing to­ward ro­bots as part of the AI build­out, tied to data cen­ters, en­ergy, land and con­struc­tion. Boston Dynamics is a prod­uct com­pany with hard en­gi­neer­ing prob­lems and a slower rev­enue curve. Son now wants the in­fra­struc­ture layer.

Hyundai wants the ro­bot on the fac­tory floor. That is a nar­rower bet, but it is eas­ier to judge. By 2028, Atlas is sup­posed to be do­ing real work in Georgia, not just walk­ing across a stage in Las Vegas. If Hyundai can turn that into re­peat­able man­u­fac­tur­ing value, the SoftBank exit will look less like a tidy cleanup and more like the mo­ment Hyundai stopped bor­row­ing a ro­bot­ics fu­ture and de­cided to own it out­right.

Also read: Texas just rewrote the rules for con­nect­ing AI data cen­ters to its power grid • Elastic’s $85 mil­lion bet on DeductiveAI is a sig­nal that AI-native ops tool­ing is now ac­qui­si­tion cur­rency • The U.S. gov­ern­ment just told ASML one of its most re­stricted ma­chines may be in­side China

Today’s links

Spying on kids to save kids from spy­ing is very, very stu­pid: First they came for the VPNs.

Hey look at this: Delights to delec­tate.

Object per­ma­nence: RIP Darwin’s tor­toise; ISPs con­spire to cre­ate copy­right jail; Waxy v fair use; Broken Windows is BS; Google is a ma­chine-learn­ing com­pany; “Writing the Other”; Canadian wealth-tax.

Upcoming ap­pear­ances: Toronto, NYC, Philadelphia, Chicago, London, Edinburgh, Sydney, Melbourne, Brighton, London, South Bend.

Recent ap­pear­ances: Where I’ve been.

Latest books: You keep read­in’ em, I’ll keep writ­in’ ’em.

Upcoming books: Like I said, I’ll keep writ­in’ ’em.

Colophon: All the rest.

Spying on kids to save kids from spy­ing is very, very stu­pid (permalink)

The lit­er­a­ture on harms to kids from on­line plat­forms is com­plex and nu­anced, rife with peo­ple cit­ing small, am­bigu­ous stud­ies as iron-clad ev­i­dence that kids are be­ing de­stroyed by the in­ter­net:

https://​www.youtube.com/​watch?v=Ype6c6D­dHQY

It’s a weird coali­tion of anti-Big Tech cam­paign­ers (who are rightly an­gry at the plat­forms’ cal­lous dis­re­gard for user wel­fare) and Heritage Foundation-backed cul­ture war­riors (who think that if their kids aren’t ex­posed to LGBTQ con­tent they won’t come out as queer). While there’s plenty these groups dis­agree about, they share one con­sen­sus: there should be a “minimum age” for cer­tain kinds of in­ter­net use.

The prob­lem is, there’s no such thing as “age ver­i­fi­ca­tion” for the in­ter­net. What we call “age ver­i­fi­ca­tion” is ac­tu­ally mass sur­veil­lance, so in­va­sive and per­va­sive that it makes the ad-tech in­dus­try’s com­mer­cial sur­veil­lance look like some kind of cypher­punk dark­net pi­rate utopia:

https://​plu­ral­is­tic.net/​2025/​08/​14/​bellovin/#​wont-some­one-think-of-the-cryp­tog­ra­phers

“Age ver­i­fi­ca­tion” means that every­one who does any­thing on­line will have to sub­mit to fine-grained track­ing and record­ing of all their on­line ac­tiv­i­ties. This night­mare is the sur­veil­lance ad­ver­tis­ing in­dus­try’s fond­est dream, a world where it’s lit­er­ally il­le­gal to avoid their track­ing, all in the name of sav­ing kids…from them!

So it’s not just a weird al­liance of anti-Big Tech cru­saders and the con­spir­a­to­r­ial right that’s push­ing for age ver­i­fi­ca­tion — they are un­wit­ting al­lies of the very tech in­dus­try they think they’re fight­ing. Those tech in­dus­try in­sid­ers are fully aware that an “age ver­i­fi­ca­tion” man­date is re­ally a way for the gov­ern­ment to teach every child how to use a VPN. They’re also fully aware that the next move is to ban VPNs:

https://​www.ex­press.co.uk/​news/​uk/​2217934/​vpn-ban-table-july-labour

Tech bosses are the ones sit­ting on our shoul­ders say­ing, “Go ahead, swal­low that fly — it’ll be fine. And if you do have to swal­low a spi­der af­ter­ward, well, that’ll surely be the end of it”:

https://​plu­ral­is­tic.net/​2026/​05/​19/​shes-dead-of-course/#​con­sen­sus-hal­lu­ci­na­tion

Behind them is a long line of caliper-wield­ing grifters who claim they can use your phone’s cam­era to dis­tin­guish a child who is 17 years, 364 days old from an adult who’s just turned 18:

https://​www.gov.uk/​gov­ern­ment/​pub­li­ca­tions/​fa­cial-age-es­ti­ma­tion

It’s be­yond farce. After all, what­ever harms you be­lieve the in­ter­net is in­flict­ing on kids — and there’s ab­solutely some kids who are be­ing harmed by their in­ter­net use — those harms all start with sur­veil­lance. Your kids can’t be tar­geted by al­go­rithms with­out the sur­veil­lance data that’s be­ing used to tar­get them. They can’t be fun­neled into pro-anorexia con­tent or ex­treme misog­yny fo­rums with­out that fun­nel be­ing primed by com­mer­cial spy­ing.

Why do tech com­pa­nies spy on your kids? The same rea­son your dog licks its balls: be­cause they can, and no one stops them:

https://​plu­ral­is­tic.net/​2026/​03/​10/​ice-tech/#​fore­see­able-out­comes

America has­n’t up­dated its con­sumer pri­vacy laws since 1988 (when Congress banned the dis­clo­sure of your VHS rentals). The EU has the GDPR, but it also has Ireland, the coun­try where all GDPR cases against Big Tech go to die, be­cause any tax haven in­evitably be­comes a crime haven:

https://​plu­ral­is­tic.net/​2025/​10/​31/​los­ing-the-crypto-wars/#​sur­veil­lance-mo­nop­o­lism

Other coun­tries have pri­vacy laws to vary­ing de­grees, but are grossly out­matched by US tech gi­ants, who have fused with the Trump regime, to the ex­tent that Trump will im­pose penal­ties on your coun­try if you at­tempt to reg­u­late his tech com­pa­nies — he’ll even have your top of­fi­cials cut off from the in­ter­net in re­tal­i­a­tion:

https://​plu­ral­is­tic.net/​2026/​04/​04/​dig­i­tal-sub­ju­ga­tion/#​green­lands-next

Any at­tempt to save kids from on­line harms should start with sav­ing kids from on­line sur­veil­lance, but that’s the op­po­site of what we’re do­ing to­day. After decades of fail­ing to pass and en­force pri­vacy con­trols for the in­ter­net, those same gov­ern­ments are break­ing all land-speed records to pass “age ver­i­fi­ca­tion” laws that make pri­vacy il­le­gal:

https://​bsky.app/​pro­file/​re­bec­ca­w­illiams.info/​post/​3moviqzdit22z

The fact that these bills have the firm back­ing of the tech in­dus­try’s most con­trol­ling, most spy­ing com­pa­nies tells you every­thing you need to know about them:

https://​web.archive.org/​web/​20260315022337/​https://​tbotepro­ject.com/

Kids are be­ing harmed by on­line spy­ing, and so are the rest of us. Whether you think that the al­go­rithm made Grampy go Qanon or you’re sus­pi­cious that on­line sur­veil­lance data was used to deny you a loan, a job, or a lease, you should want pri­vacy:

https://​plu­ral­is­tic.net/​2023/​12/​06/​pri­vacy-first/#​but-not-just-pri­vacy

Online sur­veil­lance is be­ing used to raise the prices you pay and lower the wages you’re of­fered:

https://​plu­ral­is­tic.net/​2026/​04/​06/​em­piri­cism-wash­ing/#​veena-dubal

And the same data that’s be­ing used to “verify age” to­day will be used by ICE to­mor­row to fig­ure out who to round up for a con­cen­tra­tion camp:

https://​www.wired.com/​story/​ice-asks-com­pa­nies-about-ad-tech-and-big-data-tools/

You can’t pro­tect kids from on­line sur­veil­lance by spy­ing on them. You just can’t. Anyone who tells you oth­er­wise is try­ing to get you to swal­low a fly so they can sell you a spi­der, a bird, a cat, and an ICE chud in a gaiter, Oakleys and plate car­rier (beneath which lurks a stick-and-poke Totenkopf tat­too).

Hey look at this (permalink)

AI doomerism is mis­placed. Here’s what it will take to pop the bub­ble https://​www.sa­lon.com/​2026/​06/​22/​ai-doomerism-is-mis­placed-heres-what-it-will-take-to-pop-the-bub­ble/

Visa and Mastercard: The Original Gangsters of Electronic Collusion https://​www.thes­ling.org/​visa-and-mas­ter­card-the-orig­i­nal-gang­sters-of-elec­tronic-col­lu­sion/

Visa and Mastercard: The Original Gangsters of Electronic Collusion https://​www.thes­ling.org/​visa-and-mas­ter­card-the-orig­i­nal-gang­sters-of-elec­tronic-col­lu­sion/

Has it hap­pened yet? https://​ha­sithap­penedyet.org/

Has it hap­pened yet? https://​ha­sithap­penedyet.org/

Platform-Controlled Search and Distortions in Attention Allocation https://​tin­ber­gen.nl/​dis­cus­sion-pa­per/​6496/​26 – 035-vii-plat­form-con­trolled-search-and-dis­tor­tions-in-at­ten­tion-al­lo­ca­tion

Platform-Controlled Search and Distortions in Attention Allocation https://​tin­ber­gen.nl/​dis­cus­sion-pa­per/​6496/​26 – 035-vii-plat­form-con­trolled-search-and-dis­tor­tions-in-at­ten­tion-al­lo­ca­tion

Object per­ma­nence (permalink)

#20yrsago Darwin’s tor­toise dead at 176 https://​web.archive.org/​web/​20060704143750/​http://​news.ya­hoo.com/​s/​afp/​20060623/​od_afp/​aus­trali­aan­i­mal_060623102146;_ylt=Ave_b4P­s2r9T­GX­qs5nZIV­Io­FO7gF;_ylu=X3oDM­TA5bGV­na3N­hB­HN­lY­wNzc3JlbA–zoo

#15yrsago Major US ISPs set to limit re­peat in­fringers with throt­tling, lim­it­ing ac­cess to 200 web­sites, and copy­right reed­u­ca­tion school https://​web.archive.org/​web/​20111105225114/​http://​news.cnet.com/​8301 – 31001_3 – 20073522-261/​ex­clu­sive-top-isps-poised-to-adopt-grad­u­ated-re­sponse-to-piracy/

#15yrsago Why fair use does­n’t work un­less you’ve got a huge war-chest for pay­ing lawyers https://​waxy.org/​2011/​06/​kind_of_screwed/

#15yrsago Model net neu­tral­ity rule for mu­nic­i­pal­i­ties https://​web.archive.org/​web/​20110626114610/​http://​en­vi­sion­seat­tle.org/​2011/​06/​model-net-neu­tral­ity-or­di­nance-for-seat­tle.html

#15yrsago Campus hookups: col­lege sex is­n’t new, but hookups are dif­fer­ent https://​the­so­ci­ety­pages.org/​socim­ages/​2011/​06/​21/​the-promise-and-per­ils-of-hook-up-cul­ture/

#15yrsago A Brief History of the Corporation: un­der­stand­ing what an at­ten­tion econ­omy is and where it comes from https://​rib­bon­farm.com/​2011/​06/​08/​a-brief-his­tory-of-the-cor­po­ra­tion-1600-to-2100/

#15yrsago Eliza: what makes you think I’m a psy­chother­a­peu­tic chat­bot? https://​www.fil­fre.net/​2011/​06/​eliza-part-1/

#10yrsago Broken Windows polic­ing is non­sense https://​www.nyc.gov/​as­sets/​oignypd/​down­loads/​pdf/​Qual­ity-of-Life-Re­port-2010 – 2015.pdf

#10yrsago How it feels to be un­der DDoS at­tack https://​www.or­eilly.com/​radar/​ddos-emo­tions/

#10yrsago 2016: the first pres­i­den­tial elec­tion in 50 years with­out Voting Rights Act pro­tec­tions https://​www.rolling­stone.com/​pol­i­tics/​pol­i­tics-news/​wel­come-to-the-first-pres­i­den­tial-elec­tion-since-vot­ing-rights-act-gut­ted-179737/​3/

#10yrsago Google is re­struc­tur­ing to put ma­chine learn­ing at the core of all it does https://​web.archive.org/​web/​20180530051703/​https://​www.wired.com/​2016/​06/​how-google-is-re­mak­ing-it­self-as-a-ma­chine-learn­ing-first-com­pany/

#10yrsago Misconfigured data­base ex­poses sen­si­tive data for 154 mil­lion US vot­ers https://​dai­ly­dot.com/​pol­i­tics/​154-mil­lion-voter-files-ex­posed-l2

#10yrsago To un­der­stand the Trump cam­paign, study real-es­tate de­vel­oper hus­tle https://​web.archive.org/​web/​20161028030522/​https://​storify.com/​KC_EDM/​trump-is-run­ning-his-cam­paign-like-a-real-es­tate-d

#10yrsago Writing the Other: in­tensely prac­ti­cal ad­vice for rep­re­sent­ing other cul­tures in fic­tion https://​memex.craphound.com/​2016/​06/​23/​writ­ing-the-other-in­tensely-prac­ti­cal-ad­vice-for-rep­re­sent­ing-other-cul­tures-in-fic­tion/

#1yrago The case for a Canadian wealth tax https://​plu­ral­is­tic.net/​2025/​06/​23/​bil­lion­aires-eh/#​galen-we­ston-is-a-rat

Upcoming ap­pear­ances (permalink)

Toronto: The Sovereignty Debate (IAB Canada’s State of the Nation), Jun 23 https://​iab­canada.com/​state-of-the-na­tion-2026

Toronto: The Reverse Centaur’s Guide to Life After AI (Osler Records/Type Books), Jun 23 https://​www.eventbrite.com/​e/​cory-doc­torow-book-launch-and-talk-tick­ets-1991501299998

Toronto: The Reverse Centaur’s Guide to Life After AI (Osler Records/Type Books), Jun 23 https://​www.eventbrite.com/​e/​cory-doc­torow-book-launch-and-talk-tick­ets-1991501299998

NYC: The Reverse Centaur’s Guide to Life After AI with Jonathan Coulton (The Strand), Jun 24 https://​www.strand­books.com/​cory-doc­torow-the-re­verse-cen­taur-s-guide-to-life-af­ter-ai.html

NYC: The Reverse Centaur’s Guide to Life After AI with Jonathan Coulton (The Strand), Jun 24 https://​www.strand­books.com/​cory-doc­torow-the-re­verse-cen­taur-s-guide-to-life-af­ter-ai.html

Philadelphia: The Reverse Centaur’s Guide to Life After AI with David Williams (Fitler Club/Philadelphia Citizen), Jun 25 https://​www.eventbrite.com/​e/​cory-doc­torow-book-event-tick­ets-1990110326559

Philadelphia: The Reverse Centaur’s Guide to Life After AI with David Williams (Fitler Club/Philadelphia Citizen), Jun 25 https://​www.eventbrite.com/​e/​cory-doc­torow-book-event-tick­ets-1990110326559

Chicago: The Reverse Centaur’s Guide to Life After AI with Rick Perlstein (Exile in Bookville), Jun 26 https://​ex­ilein­bookville.com/​events/​50628

Chicago: The Reverse Centaur’s Guide to Life After AI with Rick Perlstein (Exile in Bookville), Jun 26 https://​ex­ilein­bookville.com/​events/​50628

London: Idler Festival, Jul 11 https://​www.idler.co.uk/​fes­ti­val/

London: Idler Festival, Jul 11 https://​www.idler.co.uk/​fes­ti­val/

Edinburgh International Book Festival with Jimmy Wales, Aug 17 https://​www.ed­book­fest.co.uk/​events/​the-front-list-cory-doc­torow-and-jimmy-wales

Edinburgh International Book Festival with Jimmy Wales, Aug 17 https://​www.ed­book­fest.co.uk/​events/​the-front-list-cory-doc­torow-and-jimmy-wales

Sydney: The Festival of Dangerous Ideas, Aug 23 – 24 https://​fes­ti­val­of­dan­ger­ousideas.com/​cory-doc­torow/

Sydney: The Festival of Dangerous Ideas, Aug 23 – 24 https://​fes­ti­val­of­dan­ger­ousideas.com/​cory-doc­torow/

Melbourne: Enshittification at the Wheeler Centre, Aug 25 https://​www.wheel­er­centre.com/​events-tick­ets/​sea­son-2026/​cory-doc­torow-en­shit­ti­fi­ca­tion

Melbourne: Enshittification at the Wheeler Centre, Aug 25 https://​www.wheel­er­centre.com/​events-tick­ets/​sea­son-2026/​cory-doc­torow-en­shit­ti­fi­ca­tion

Brighton: The Reverse Centaur’s Guide to Life After AI with Carole Cadwalladr (Brighton Dome), Sep 8 https://​brighton­dome.org/​whats-on/​LSC-cory-doc­torow-the-re­verse-cen­taurs-guide-to-life-af­ter-ai/

Brighton: The Reverse Centaur’s Guide to Life After AI with Carole Cadwalladr (Brighton Dome), Sep 8 https://​brighton­dome.org/​whats-on/​LSC-cory-doc­torow-the-re­verse-cen­taurs-guide-to-life-af­ter-ai/

London: The Reverse Centaur’s Guide to Life After AI with Riley Quinn (Foyle’s Picadilly), Sep 9 https://​www.foyles.co.uk/​events/​en­shit­ti­fi­ca­tion-cory-doc­torow-ri­ley-quinn

London: The Reverse Centaur’s Guide to Life After AI with Riley Quinn (Foyle’s Picadilly), Sep 9 https://​www.foyles.co.uk/​events/​en­shit­ti­fi­ca­tion-cory-doc­torow-ri­ley-quinn

South Bend: An Evening With Cory Doctorow (Notre Dame), Oct 6 https://​franco.nd.edu/​events/​2026/​10/​06/​an-evening-with-cory-doc­torow/

South Bend: An Evening With Cory Doctorow (Notre Dame), Oct 6 https://​franco.nd.edu/​events/​2026/​10/​06/​an-evening-with-cory-doc­torow/

Recent ap­pear­ances (permalink)

How to Mess with Big Tech Oligarchs (Fighting Fascism) https://​pod­casts.ap­ple.com/​us/​pod­cast/​how-to-mess-with-big-tech-oli­garchs-w-cory-doc­torow/​id1888647397?i=1000773711479

Reverse Centaur with Angie Coiro (Kepler’s Books) https://​www.youtube.com/​live/​cWN6XBa73xA

Reverse Centaur with Angie Coiro (Kepler’s Books) https://​www.youtube.com/​live/​cWN6XBa73xA

How to Think About AI Before It’s Too Late (Galaxy Brain) https://​www.youtube.com/​watch?v=SPQN­PJ0­CEPo

How to Think About AI Before It’s Too Late (Galaxy Brain) https://​www.youtube.com/​watch?v=SPQN­PJ0­CEPo

The fu­ture of world gov­er­nance, with Kim Stanley Robinson (UN Independent Expert on International Order) https://​www.youtube.com/​live/​wJvB­vY­daAMY

The fu­ture of world gov­er­nance, with Kim Stanley Robinson (UN Independent Expert on International Order) https://​www.youtube.com/​live/​wJvB­vY­daAMY

How to Think About Artificial Intelligence (KUER) https://​ra­diow­est.kuer.org/​show/​ra­diow­est/​2026 – 06-16/​cory-doc­torow-on-how-to-think-about-ar­ti­fi­cial-in­tel­li­gence

How to Think About Artificial Intelligence (KUER) https://​ra­diow­est.kuer.org/​show/​ra­diow­est/​2026 – 06-16/​cory-doc­torow-on-how-to-think-about-ar­ti­fi­cial-in­tel­li­gence

Latest books (permalink)

“Canny Valley”: A lim­ited edi­tion col­lec­tion of the col­lages I cre­ate for Pluralistic, self-pub­lished, September 2025 https://​plu­ral­is­tic.net/​2025/​09/​04/​il­lus­tri­ous/#​chair­man-bruce

18 June 2026

This is the story of how I found 10,000 repos­i­to­ries on GitHub that dis­trib­ute Trojan mal­ware. They are all from dif­fer­ent con­trib­u­tors, have dif­fer­ent names, and are not forks of other repos­i­to­ries. But they share a com­mon pat­tern, which is what al­lowed me to write a script to find such repos­i­to­ries.

Introduction

I have a pro­ject on GitHub, and I wanted to check whether search en­gines had in­dexed it. I typed the pro­ject name into Google, and my repos­i­tory ap­peared in the re­sults. I en­tered the same query into Bing, and some­one else’s repos­i­tory ap­peared in the re­sults, with the ex­act same name and de­scrip­tion. It was a copy of my repos­i­tory with all the com­mits, and I was listed as a con­trib­u­tor. But an hour ago, an­other com­mit was pushed with a change to the readme. A link to a zip archive has been added to it.

I was choos­ing ap­pro­pri­ate tags for an­other one of my pro­jects on GitHub. I clicked through those tags to look at sim­i­lar pro­jects. In the list, I found a repos­i­tory whose name and de­scrip­tion matched ex­actly those of an­other repos­i­tory on that list. It turned out that it also con­tained copies of all the com­mits from that repos­i­tory, and two hours ago, a link to a zip archive has been added to the readme.

After mon­i­tor­ing these two repos­i­to­ries, I dis­cov­ered that every few hours they delete the pre­vi­ous com­mit and push the ex­act same com­mit again. This com­mit con­tains only one change: adding a link to the archive in the readme file.

I sub­mit­ted a re­quest to GitHub sup­port ask­ing them to delete these repos­i­to­ries. Two weeks passed and noth­ing has changed; GitHub sup­port has­n’t re­sponded. I dis­cussed with an AI what else could be done about this, but it did­n’t of­fer any use­ful ad­vice. I opened a thread on GitHub, and three peo­ple replied with the same AI slop that was of no use at all.

Another month later, GitHub sup­port sent me an email say­ing that they had re­moved these repos­i­to­ries.

You can open other sim­i­lar repos­i­to­ries, look at the lat­est com­mit, and see that a link to a zip archive was added to the readme a few hours ago:https://​github.com/​lu­cash­eriq4374/​welinkhttps://​github.com/​lu­ci­olo­prey/​OcyShield-Frame­workhttps://​github.com/​luigi1973/​As­setRip­per-CLI

The zip archive con­tains 4 files:

Application.cmd or Launcher.cmd

loader.exe or lu­a­jit.exe or an­oth­er_­name.exe

ran­dom_­name.cso or ran­dom_­name.txt

lu­a51.dll

If you sub­mit a link to the archive to VirusTotal, it will find 0 viruses.If you sub­mit the zip file it­self, it will de­tect a Trojan in­side it.

Continued

It seemed like I had al­ready for­got­ten about this event, but my sub­con­scious had­n’t. And my sub­con­scious of­ten throws in­ter­est­ing ideas at me when I’m sleep­ing or wak­ing up. Recently, I woke up and in the very same sec­ond re­al­ized what I needed to do. I need to come up with a gen­eral pat­tern and then write a script that will an­a­lyze all GitHub repos­i­to­ries and find the ones that match that pat­tern.

Search pat­tern:

Every few hours the pre­vi­ous com­mit is deleted and a new one is pushed

Only the readme file is up­dated in the com­mit

The readme file con­tains a link to a zip archive

The com­mits are copied from an­other repos­i­tory

This is a new repos­i­tory, not a fork

All repos­i­to­ries have dif­fer­ent con­trib­u­tors and dif­fer­ent names

From the last two points, it be­comes clear that even if we find one such repos­i­tory, we won’t be able to find other sim­i­lar repos­i­to­ries us­ing it. But there are 500 mil­lion repos­i­to­ries on GitHub. How can we an­a­lyze all of them? GitHub al­lows 5,000 re­quests per hour with a sin­gle to­ken. For each repos­i­tory, we need to make sev­eral re­quests to get the list of com­mits, mod­i­fied files, and the con­tent of the readme file. I did­n’t want to wait a year for the script to an­a­lyze all the repos­i­to­ries.

But we don’t need all the repos­i­to­ries, we only need the ones that are up­dated every few hours. I found a ser­vice called gharchive, which lets you down­load all GitHub events for any given day. So we need to down­load the event archives for the last few days, fil­ter them to in­clude only com­mit push events, and iden­tify the repos­i­to­ries that are up­dated be­tween 2 and 10 times every 10 hours.

Over the past 5 days, there have been 16 mil­lion com­mit pushes. Of these, only 3,000 are repos­i­to­ries that are up­dated every few hours.

However, the events do not in­clude in­for­ma­tion about which spe­cific files were mod­i­fied. This means that for each rel­e­vant repos­i­tory, we need to make ad­di­tional re­quests to the GitHub API.

After run­ning the script, it re­turned a large num­ber of repos­i­to­ries. I added sev­eral pa­ra­me­ters to the fil­ters:

The com­mit must be from a user, not a bot

More than a month has passed be­tween the last com­mit and the one be­fore that

The repos­i­to­ries have more than one con­trib­u­tor

After that, only 14 repos­i­to­ries were found that fully matched the pat­tern. And I could­n’t stop won­der­ing: why were there so few repos­i­to­ries? What are the odds that I stum­bled upon these repos­i­to­ries two months ago and there are only 14 of them on the en­tire GitHub? There should be many more. Imagine what the head­line of this ar­ti­cle would have been if I’d found a mil­lion such repos­i­to­ries or even just a thou­sand.

But I ac­cepted the fact that there were only 14 of them and started writ­ing this ar­ti­cle. I de­cided to dou­ble-check them one more time so I would­n’t ac­ci­den­tally in­clude any un­nec­es­sary repos­i­to­ries in the ar­ti­cle. Imagine my sur­prise when I saw that they had all been up­dated 20 hours ago. So the “updated every few hours” pa­ra­me­ter was com­pletely wrong. The fil­ter had dis­carded all repos­i­to­ries that are up­dated in­fre­quently.

During my man­ual check, I also no­ticed repos­i­to­ries that con­tained a link to a zip archive and had a re­cent com­mit, but that com­mit had zero changes. The fil­ter, how­ever, only con­sid­ered repos­i­to­ries where a sin­gle readme file had been mod­i­fied in the lat­est com­mit.

I also no­ticed that the last com­mit in all of these repos­i­to­ries had the same name: “Update README.md”.

I changed the fil­ter. Now the script searched for repos­i­to­ries that were up­dated be­tween 1 and 24 times every 24 hours. It found 40,000 such repos­i­to­ries.

There were 10,000 repos­i­to­ries that ex­actly matched the pat­tern. That’s 25% of the to­tal.

Each of these repos­i­to­ries con­tains a zip archive with a Trojan.

These repos­i­to­ries have been around for many months, some even for over a year, and GitHub does not au­to­mat­i­cally de­tect and delete them.

I’ve pub­lished a com­plete list of these repos­i­to­ries on GitHub.A script for find­ing such repos­i­to­ries: Git Malware Finder

Open Questions

Why do they only clone new repos­i­to­ries, rather than pop­u­lar ones?

Why do they delete a com­mit and push a new one every few hours?

Why does­n’t GitHub au­to­mat­i­cally de­tect such repos­i­to­ries?

What ex­actly does the ex­e­cutable exe file from the archive do?

What is the ac­tual scale of this cam­paign?

My Hypotheses

The hack­ers’ goal is to un­der­stand how the sys­tem works, find its lim­i­ta­tions and vul­ner­a­bil­i­ties, and ex­ploit that in­for­ma­tion. If over­writ­ing com­mits helps by­pass GitHub’s se­cu­rity al­go­rithms, then that’s what they did. Perhaps that’s also why every com­mit is named “Update README.md”.

The sec­ond goal is to spread the virus. How do they get peo­ple to find and down­load it? I think they do this by cloning only new repos­i­to­ries, which im­me­di­ately ap­pear at the top of search en­gine re­sults for low-vol­ume search terms. They also add these repos­i­to­ries to pop­u­lar GitHub tags to in­crease the chances of in­dex­ing and to help peo­ple find them through those tags.

But why do they copy all the com­mits and con­trib­u­tors? After all, they could have just copied the en­tire source code. This is likely done to build trust. When some­one vis­its a repos­i­tory, they see the con­trib­u­tors, can click through to their pro­files, and see that these aren’t one-day ac­counts. And the com­mit his­tory is pre­served so it’s clear that the repos­i­tory did­n’t just ap­pear yes­ter­day. But per­haps this is also done to by­pass GitHub’s al­go­rithms.

These are just my as­sump­tions, but the re­al­ity may be com­pletely dif­fer­ent.

Conclusion

I was sub­ject to GitHub’s API limit of 5,000 re­quests per hour. I op­ti­mized the script to search only for rel­e­vant repos­i­to­ries, and I think that be­cause of the fil­ter, the script found only a small per­cent­age of repos­i­to­ries. The GitHub team does not have such lim­i­ta­tions. They can an­a­lyze all 500 mil­lion repos­i­to­ries, find any archives or ex­e­cutable files within them, and scan them for viruses.

This time, I won’t be send­ing a re­quest to GitHub. There are sim­ply too many repos­i­to­ries. If any of you have di­rect con­tact with GitHub’s se­cu­rity team, please send them a link to this ar­ti­cle.

* UpdateI found this ar­ti­cle from April 18: How 109 Fake GitHub Repositories Delivered SmartLoader and StealCIt ex­plains in de­tail how this Trojan mal­ware works. At that time, the au­thor had found 109 such repos­i­to­ries.

* Update 2GitHub has started delet­ing all the repos­i­to­ries that the script found. Most of these repos­i­to­ries have al­ready been deleted.

* Update 3I found a post on Reddit that men­tioned this scheme. It was posted in February 2025, al­most 1.5 years ago: If you’re cre­at­ing new repos­i­to­ries, they are be­ing spoofed to host mal­ware

* Update 4GitHub deleted only the repos­i­to­ries I listed in the com­plete list in a txt file. Then I ran the script again, it found new repos­i­to­ries, and I added them to this ar­ti­cle. Two days have passed, and these repos­i­to­ries have not been deleted. GitHub has no way to search for these repos­i­to­ries. They did­n’t run my script, and they did­n’t write their own script. They did­n’t even open this ar­ti­cle to see if the list of repos­i­to­ries had changed. They only delete repos­i­to­ries that are re­ported to them, but they don’t do any­thing else. That’s why this scheme has been go­ing on for sev­eral years now, and will most likely con­tinue.

I also pub­lish all new es­says and notes on Telegram, Bluesky and X.

whoa there, pard­ner!

Your re­quest has been blocked due to a net­work pol­icy.

Try log­ging in or cre­at­ing an ac­count here to get back to brows­ing.

If you’re run­ning a script or ap­pli­ca­tion, please reg­is­ter or sign in with your de­vel­oper cre­den­tials here. Additionally make sure your User-Agent is not empty and is some­thing unique and de­scrip­tive and try again. if you’re sup­ply­ing an al­ter­nate User-Agent string, try chang­ing back to de­fault as that can some­times re­sult in a block.

You can read Reddit’s Terms of Service here.

If you think that we’ve in­cor­rectly blocked you or you would like to dis­cuss eas­ier ways to get the data you want, please file a ticket here.

When con­tact­ing us, please in­clude your Reddit ac­count along with the fol­low­ing code:

019eea62 – 7613-7ff7-a698 – 85c31e074bc3