[GH-ISSUE #2424] Warning: fake repo rea-tools/rea distributes a trojan "Windows exe". Please add a README note #813

New issue

Closed

opened 2026-10-15 18:28:41 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:41 +00:00

Owner

Originally created by @Orb-Eater on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2424

Before submitting

I searched the existing issues for a related documentation report.
I removed credentials, tokens, private paths, and sensitive target data.

Documentation location

https://github.com/rea-tools/rea

Problem

Hi! Heads-up for you and your users: https://github.com/rea-tools/rea is a
fake copy of this project that distributes malware.

It copies your README and adds a "Windows Standalone .exe / GUI" section
pointing to a release called "rea-agents: v6.3.0".
That release serves rea-x64.7z (82.6 MB,
sha256 64116f55779f1a30250aa2497ada9199221d0f867f98575359a5c5cefa9b78a3),
downloaded 172 times so far.
Microsoft Defender flags the archive as Trojan:Script/Wacatac.B!ml and the
extracted rea-x64.exe as Trojan:Win32/Wacatac.B!ml.
VirusTotal: 8/45 engines flag it, labelled trojan/dropper (ESET:
Win64/Agent.KYH Trojan, Sophos: Mal/Generic-S, Tencent:
Win32.Trojan.Dropper.Qgil). Its sandbox tags show anti-analysis
behaviour (detect-debug-environment, long-sleeps, checks-user-input).
https://www.virustotal.com/gui/file/64116f55779f1a30250aa2497ada9199221d0f867f98575359a5c5cefa9b78a3
The org was created 2026-10-10 and has only this repo; all commits come
from the account exewprimefacesu.

The org name "rea-tools" seems chosen to look like your official site
rea.tools, which makes it extra convincing.

I've reported it to GitHub. Suggestion: add a line to the README saying the
only official downloads are the npm package rea-agents and releases on
github.com/morluto/rea (relevant once the Windows portable build from #2136
ships), so people searching for "rea download" don't get caught.

Reported by Orb Eater.
Investigated with Claude (Anthropic, Opus 5.5) and 4 Claude research agents.

Expected content

Supporting evidence

Additional context

No response

Originally created by @Orb-Eater on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2424 ### Before submitting - [x] I searched the existing issues for a related documentation report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Documentation location https://github.com/rea-tools/rea ### Problem Hi! Heads-up for you and your users: https://github.com/rea-tools/rea is a fake copy of this project that distributes malware. - It copies your README and adds a "Windows Standalone .exe / GUI" section pointing to a release called "rea-agents: v6.3.0". - That release serves rea-x64.7z (82.6 MB, sha256 64116f55779f1a30250aa2497ada9199221d0f867f98575359a5c5cefa9b78a3), downloaded 172 times so far. - Microsoft Defender flags the archive as Trojan:Script/Wacatac.B!ml and the extracted rea-x64.exe as Trojan:Win32/Wacatac.B!ml. - VirusTotal: 8/45 engines flag it, labelled trojan/dropper (ESET: Win64/Agent.KYH Trojan, Sophos: Mal/Generic-S, Tencent: Win32.Trojan.Dropper.Qgil). Its sandbox tags show anti-analysis behaviour (detect-debug-environment, long-sleeps, checks-user-input). https://www.virustotal.com/gui/file/64116f55779f1a30250aa2497ada9199221d0f867f98575359a5c5cefa9b78a3 - The org was created 2026-10-10 and has only this repo; all commits come from the account exewprimefacesu. The org name "rea-tools" seems chosen to look like your official site rea.tools, which makes it extra convincing. I've reported it to GitHub. Suggestion: add a line to the README saying the only official downloads are the npm package rea-agents and releases on github.com/morluto/rea (relevant once the Windows portable build from #2136 ships), so people searching for "rea download" don't get caught. Reported by Orb Eater. Investigated with Claude (Anthropic, Opus 5.5) and 4 Claude research agents. ### Expected content . ### Supporting evidence <img width="1920" height="1080" alt="Image" src="https://github.com/user-attachments/assets/2e59f4ff-6304-4038-b3f9-e13aaa1b82ad" /> ### Additional context _No response_

bsakaguchi

2026-10-15 18:28:41 +00:00

closed this issue
added the
triage

documentation
labels

bsakaguchi commented

2026-10-15 18:28:42 +00:00

Author

Owner

@ylwl1997 commented on GitHub (Oct 13, 2026):

Thanks for the detailed report (VT + Defender labels + org created 2026-10-10).

+1 on a README “official distribution” note: npm package rea-agents and releases under github.com/morluto/rea only — never third-party “Windows standalone exe” mirrors, especially ones mimicking rea.tools naming.

I can open a small docs PR with proposed wording if maintainers want it. Separately I’ll add the same caution to the community install guide so search traffic has a second warning surface.

@ylwl1997 commented on GitHub (Oct 13, 2026): Thanks for the detailed report (VT + Defender labels + org created 2026-10-10). +1 on a README “official distribution” note: npm package `rea-agents` and releases under github.com/morluto/rea only — never third-party “Windows standalone exe” mirrors, especially ones mimicking rea.tools naming. I can open a small docs PR with proposed wording if maintainers want it. Separately I’ll add the same caution to the community install guide so search traffic has a second warning surface.

bsakaguchi referenced this issue

2026-10-16 21:16:25 +00:00

[PR #813] [MERGED] fix(browser): distinguish WebMCP registration frame owners #2260

bsakaguchi referenced this issue

2026-10-16 21:16:27 +00:00

[PR #815] [MERGED] fix: integrate 24 reviewed browser/native/semantics corrections #2262

bsakaguchi referenced this issue

2026-10-31 00:40:59 +00:00

[GH-ISSUE #5736] [Bug] WebMCP discovery marks a main-frame-only replay complete when subframes already have tools #3483

bsakaguchi referenced this issue

2026-10-31 00:44:44 +00:00

[GH-ISSUE #6449] [Bug] compare-web-captures reports WebMCP changes from capture-local frame IDs #3862