A rival shipped a 0-yuan free-purchase exploit, and it wrote the flaws out one by one as "we don't have": TuraIDC's first 100 stars are real, the last 170 should be questioned

TuraIDC is an open-source release of the business and finance system that a small Chinese cloud provider, Erwu Cloud (二五云), used internally. Zhijian Mofang Finance, the closed-source commercial system almost every small Chinese IDC uses, kept having problems around then, and TuraIDC launched right at that moment, with a one-click migration from Mofang. It built up about 100 stars in the IDC peer circle. From Nov 4 it added over forty stars a day, and this stretch looks more like bought stars. Below: what it is, where the real stars came from, what is packaging, and which half to learn from if you want to copy it.

An announcement that opened with "Dear IDC peers"

Around Aug 18, year 2026, a cloud provider posted an announcement in a Telegram channel, which was quickly reposted to the VPS forum nodeseek under the title "Mofang Finance reportedly has a sudden 0-yuan free-purchase exploit". The announcement opened with "Dear IDC peers, important vulnerability warning": Mofang Finance's /v1 endpoint only needs a resource_percent_value=0 parameter to buy a paid server for 0 yuan. The cause was that the server trusted the discount parameter sent by the frontend without recalculating the price itself.

Two more sentences were even harder for merchants using Mofang: "It is understood that Mofang Finance's official side has packaged the business for sale to a third-party company, and it is highly uncertain whether the official side will fix this promptly in the short term", and the poster's own patch "only fixed the order logic; upgrades, downgrades and renewals still have the issue". The ownership change is only what merchants said and has not been verified.

On Aug 14, 4 days ago, a repo called 25Cloud/TuraIDC had just been created on GitHub. On Aug 20 it released three versions in one day, from v0.3.1 to v0.3.3.

On Oct 9, someone posted on nodeseek again saying that a third-party Mofang theme template had a backdoor planted by its original author, allowing WebShell uploads and deleting an entire site; a fofa scan found about 1000 sites in the affected range. The poster specifically noted the backdoor was not from Mofang itself. But for small IDC owners the problem is the same: the system that runs their billing and machines is encrypted, with no visible source code.

TuraIDC's README has a section called "❌ We don't have", whose first item is "No zero-yuan amount tampering vulnerability: order and renewal amounts are always recalculated server-side by rule, and client parameters (such as billing multipliers) cannot change the payable amount to zero or negative". Below that are "No unauthenticated upstream vulnerability", "No arbitrary file upload", "No feature locking and no backdoor", and "No payment callback replay". Mofang users reading these lines recognize every pitfall they've hit.

What it is

A business operations system for IDCs and cloud providers: small merchants selling cloud servers use it to manage products, order billing, connect to upstream systems for automatic provisioning, top-ups, invoices, tickets, and distributor commissions. The backend uses Laravel 12, the frontend uses Vue 3, there are three frontends (admin panel, website, user console), and it is AGPL open-source.

It is not a demo. Erwu Cloud's own site idc.25y.cn runs on it; the Nov 1 v0.4.4 release notes say "809 live products in production". It shipped 11 versions within 84 days of the repo's creation; v0.4.3 alone was 78 commits; the docs site covers three deployment methods (BT Panel, Docker, bare metal) and includes a full API list. Projects with only a hundred or two stars rarely reach this level of completeness.

Licensing: the AGPL edition is free forever; merchants who don't want to open-source can buy a closed-source commercial license for 200 yuan a year, with identical features and no license check.

Where the real stars came from: the peer circle, plus zero-cost migration

The first 100 or so stars were earned between August and October, and on Oct 9 it was 101 stars (GitHub daily star count). The sources were very concentrated, all IDC peers:

• Partner IDCs co-wrote code. The Trusted Partners section of the README lists 7iNet, Starry Cloud StarVM, idcxl, and Shanshui Cloud. Shanshui2024, PigFully and yellowface233, among the first ten forks, later became contributors; on Oct 21 StarVM also submitted an integration module for Rain Cloud. Rivals became co-builders, and these people starred it too.
• Switching costs almost nothing. It can be natively connected by Mofang as an upstream, and can also connect to Mofang upstreams; the docs have a chapter "Migrating from Zhijian Mofang Finance" that moves users, products, orders, upstreams and real-name data over as a whole. For a small IDC with several hundred customers, this matters more than extra features.
• QQ group. The README links to a group, and it spread by word of mouth in the circle.

Almost nobody discussed it publicly. Searches on nodeseek, hostloc and linux.do turn up no threads about TuraIDC, and nobody mentions it on X; the only results are auto-generated intro pages from open-source aggregator sites like kaiyuanbang and reporank.

The 4 stars after Nov 170: looks bought

From Oct 28 to Nov 3, its stars stayed flat at 96 to 98. On Nov 4 it became 142, on Nov 5 191, on Nov 6 233, and that evening GitHub showed 272 (GitHub daily star count, 11-06). There were no new releases in those three days, and no post or repost could be found to explain this jump.

Several new fork accounts appeared at the same time, and they look alike: fry-oink5h, invoiceattempt32, stander-puffier-5f, mystic-bagels8i, all registered only from 8 to October, with 0 followers, and bios made of templated English phrases ("woodworking lover. coffee on weekends. Designer.", "Civil Engineer — coffee, tennis"). Each account forked four or five unrelated small Chinese repos. They also starred the same batch of repos, such as dyz-gongwen-skills and Rice-dog/code-codex, which surged in the same week: one gained +156 in 7 days, another +345 in 7 days. This is a typical trace of Chinese star-farming services. The list of stargazers could not be obtained this time, so the accounts could not be checked one by one; "bought" is therefore an inference, but a fairly confident one.

Seen this way, TuraIDC's real scale is "84 days, about 100 stars, one vertical niche", not "+136 a week".

Who it's competing with

In the domestic slot, there is no second open-source project still maintained and reasonably complete; the overseas open-source ones don't connect to the domestic ecosystem. After the Mofang incident, the only similar things that appeared were silveridc/cloud-manager-system with 0 stars and a Mofang plugin open-sourced by a tech company, neither of which took off. Nobody has copied it.

If it were you

In one line: what's worth learning is the playbook: when a closed-source system everyone in the industry uses has a security incident, release an open-source alternative, turn the rival's flaws into "we don't have" points, and make one-click migration work well. The project itself isn't worth following: the position is already taken, and its real stars are only a hundred-odd.

Who it suits: developers or small merchants already working in a specific vertical who have a home-built system in use (hosting providers, e-commerce ERP, school admin, store POS all count), where the industry standard is a closed-source, encrypted commercial product whose reputation is slipping.

Who it doesn't suit: anyone hoping to build reputation with thousands of stars from an open-source project. The audience for B2B vertical systems is a few hundred to a few thousand merchants, and even at TuraIDC's level of completeness, organic growth is only about 100 stars. It also doesn't suit anyone planning another domestic IDC finance system, since TuraIDC already exists.

How to do it:

1. Switch industries: find an industry software that "everyone uses, is closed-source and encrypted, and has recently had a vulnerability or changed hands", and build an open-source rewrite. Write the compatibility layer and migration tools first, then fill in features.
2. Switch regions: the overseas open-source FOSSBilling and Paymenter don't connect to the domestic ecosystem. Conversely, localized hosting billing systems in other countries (local payments, local real-name verification, local upstreams) may have the same gap; this has not been verified.
3. Do what it didn't do well: TuraIDC's native Mofang integration is still marked "experimental". A standalone migration tool or security audit script focused on moving off Mofang could also draw attention from the same group of users.

How to get customers: Start with peers. Put the shops willing to use it into the README as partners, so they fork it and submit code. When a rival gets into trouble, show up in that industry's forums and groups, and match each "we don't have this" line in the README against the rival's specific flaws. Back it up with screenshots and real numbers from your own production site (listed products, API latency). Buying stars makes a repo look busy for a few days, but it won't bring in a single real user.

Timing: get in before: This kind of opportunity follows a rival's incident. A few months after the incident, users have either already switched or fixed the problem and stayed put. You need a usable version within days to weeks after the next incident goes public. TuraIDC was created 4 days before the vulnerability was disclosed and shipped a release 2 days after.

Verdict: a misread: ① The company that took over Mofang fixed the vulnerability and resumed updates, and the IDC crowd stopped discussing replacement. So this kind of "rival in trouble" window is short and only lasts for one wave. ② Over the next month or two TuraIDC's stars fell back to single digits per week, and the partner wall stopped growing. The approach only earned a small circle in vertical B2B, not reach. ③ On the other hand, if IDC forums or WeChat Official Accounts start recommending it at scale, and visibly more merchants adopt it, then "open-source drop-in replacement + migration" can really displace the incumbent in an industry in trouble, and it's worth repeating in the next industry.

---

Data and sources: GitHub repo 25Cloud/TuraIDC README, Releases, forks and contributors (11-06); GitHub daily star counts (10-09, 10-28 to 11-06); nodeseek posts post-880856 (Mofang 0 free purchase, about 08-18) and post-973651 (Mofang theme template backdoor, 10-09); turaidc.com, docs.turaidc.com, idc.25y.cn; rival GitHub pages. The claim that Mofang was "packaged and sold to a third party" comes from a vendor announcement and is unverified. Stars after Nov 4 were bought; this is an inference based on the characteristics of the fork accounts and the fact that same-batch repos rose in sync.