Simple queries, measured.

All eight confirmed payload variants checked contain a literal run(); seven end with that call. Yet the GitHub literal search returned four files outside our reviewed cases, and the web end-of-file regex returned zero. A source signature and a working discovery query are separate things.

The global.i queries retrieved known payload blob hashes and many additional candidates. Their result counts are not confirmed cases. Only the first page was retrieved for each broad query, and GitHub's API limits retrieval to 1,000 results per query.

Following the marker results

Crossmatching those saved results with known payload blobs identified 95 repository leads outside the earlier register. A selected 13 now have reviewed malicious-content evidence and matching current default-branch commits. The remaining 82 leads are unchecked, not false positives.

Eleven tasks name the payload's exact path. Two name lowercase public while the file is under Public; that target resolves only on a case-insensitive filesystem. The same loader bytes occur under both 400-font and 500-font names, so filename-only rules are incomplete.

The 13 repositories also share four editor-configuration blobs. These are useful correlation pivots, not standalone malicious indicators. A test for a shared launch-profile string returned zero indexed results despite its presence in the reviewed files; search-index recall remains a limitation.

Download the pinned follow-up evidence ↓ · Per-repository OSM comparison → · Shared hashes and wallet →

run in font

4 files reported · 4 retrieved · no API incomplete flag.

path:*.woff2 "run()"

Try in GitHub web search ↗

Exact REST query used for these counts
"run()" extension:woff2

rpc in font

0 files reported · 0 retrieved · no API incomplete flag.

path:*.woff2 "eth_getTransactionCount"

Try in GitHub web search ↗

Exact REST query used for these counts
"eth_getTransactionCount" extension:woff2

run named font

0 files reported · 0 retrieved · no API incomplete flag.

path:fa-solid-500.woff2 "run"

Try in GitHub web search ↗

Exact REST query used for these counts
"run" filename:fa-solid-500.woff2

global in font

1809 files reported · 100 retrieved · no API incomplete flag.

path:*.woff2 "global.i"

Try in GitHub web search ↗

Exact REST query used for these counts
"global.i" extension:woff2

global 500

372 files reported · 100 retrieved · no API incomplete flag.

path:fa-solid-500.woff2 "global.i"

Try in GitHub web search ↗

Exact REST query used for these counts
"global.i" filename:fa-solid-500.woff2

global 400

1437 files reported · 100 retrieved · no API incomplete flag.

path:fa-solid-400.woff2 "global.i"

Try in GitHub web search ↗

Exact REST query used for these counts
"global.i" filename:fa-solid-400.woff2

The end-of-file experiment

path:*.woff2 /run\(\);?\s*$/

GitHub web search returned zero during this check, despite seven positive raw-source matches. Do not use a zero result to dismiss the repository evidence. The four literal-query hits have not been adjudicated as malicious or benign.

Observed September 7, 2026 UTC. Download counts, first-page metadata and source backtest ↓ · Task-based hunt audit →