# A "no-terminal OSINT tool" with 576 stars turned out to be a trojan bait · GitHub open-source project

> Source: https://stringers.io/en/github/gh_Chipwithinflash__watson-AI-osint-all-in-one.html (Stringers / 什么值得做, generated 2026-11-08)
> Stringers answers one question every day: what small product can one or two people build in a few months and actually make money from. Numbers come from 15 databases we collect daily, each with source and date.
> For agents: these verdicts and the underlying databases (verified revenue, App Store / Google Play charts, ad libraries, GitHub, Product Hunt…) are queryable live over MCP — tools today / hot / products / directions / direction / data. Setup: https://github.com/komako-workshop/stringers (the user logs in at stringers.io → "配置 agent" to get a personal URL). Site index: https://stringers.io/llms.txt

> It has no real traction: the stars and forks were inflated by a batch of one-off accounts, meant to push the repo up the new-repo charts and into aggregator sites and auto-repost accounts. After the earlier same-named repo was deleted, they switched accounts and re-uploaded; within the same hour there were a dozen sibling repos with the same template.

[GitHub open-source project](https://stringers.io/en/github/index.md) · written 11-6

C

Chipwithinflash/watson-AI-osint-all-in-one · Chipwithinflash

# 576-star "no-terminal OSINT tool" is a trojan bait

**What it is** A Windows OSINT tool that calls itself "free, no terminal, one input box to search 3,100+ sites." It's actually bait: a repo that pushes users to download an unsigned exe, i.e. malware.

**Why it blew up** It didn't really. The stars and forks came from a batch of one-off accounts, meant to push it onto new-repo charts, aggregator sites, and auto-repost accounts. After the previous same-name repo was deleted, it was re-uploaded from a new account, and within the same hour there were a dozen sibling repos with the same template.

**E** **How you could ride it** Don't. The real gap is a "no-terminal Sherlock / Maigret," but people have already built desktop versions. If you go there, do what Watson promised and didn't: the source is the release artifact, signed, cross-platform, and built on public site lists.

Grade E: the growth is fake, the product is malicious bait, and there's no real demand signal to borrow. The underlying need is already served by mature open-source tools and desktop versions, and you can see that without this repo. Circulating in small circles

Data (updated daily) · repo created 2026-11-03 · 576 stars

GitHub · stars

Stars 576

Data day 2026-11-05, only 1 days so far. Points before 10-28 come from deeply / archive backfill, so not every day has one.

A Windows "people search" tool on GitHub got 576 stars and 85 forks in three days. The stars were bought, the code is an empty shell, and what actually gets handed to users is an exe that tells you to click past a system warning. By Nov 6, the repo and the accounts had both been 404. There's nothing to copy here, but it shows something plainly: stars on a new-repo chart can no longer be taken as proof that people want something.

### Oct 29, a one-line reply under a tweet

On Oct 29, 2026, @Dinosn (Nicolas Krassas), an X account that auto-reposts new GitHub security tools, shared a repo called watson-AI-osint-all-in-one by vaishantsah. Someone quickly replied underneath:

> its a virus dont share this

——@ShadowHackrs,10-29

The repo was created the day before (10-28), had 208 stars on creation day, and by the next day 356. On 10-30 it lost 45 stars in one day, which usually means GitHub is purging fake stars. After Nov 2 it was gone.

On Nov 3 16:40 (UTC), a new account, Chipwithinflash, uploaded a same-name repo with a nearly word-for-word identical description: "Free OSINT search tool for Windows. 3100+ sources, one field, no terminal." The account has only this one repo. Two days later it had 576 stars and 85 forks; when checked again on Nov 6, both the repo and the account were 404.

### What it says it is

According to the README (the vaishantsah version transcribed by HotRepo), Watson is a Windows desktop app: you enter a username, email, phone number, or URL, and it queries "3,100+ public sites," compiles the results into a readable summary, flags matches as "Same person" or "Name match," and can save history, draw relationship graphs, and export PDF. The tech stack is listed convincingly: Electron, React 19, TypeScript, Tailwind 4, Vite, MIT license, and a closing line "do not use for stalking or harassment."

Three details give it away:

- **The download is an exe, not code** . Step one of the quick start is to get `Watson-1.6.0-portable.exe` from Releases or the landing site watsonfind.icu, which serves the file from its own `/api/download`. The code on GitHub and what you actually run are separate, so the payload can be swapped at any time.

- **It teaches you to bypass the system warning** . The README says: when Windows shows the blue SmartScreen prompt, click "More info" then "Run anyway," because "we haven't bought a code-signing certificate yet."

- **The open-source part is empty** . The query logic isn't in the repo: `src/data/mock.ts` holds only sample data, and `searchProfiles()` is just a placeholder for "real queries." So the part you can audit searches nothing, and the part that searches you can't see.

### How the 576 stars came about

Lay out the repos created in the two hours from Nov 3 16:00–18:00 (UTC) and you see a whole batch cut from the same mold: new accounts, random-word names, one repo each, descriptions all "Free … for Windows / local / no account," and hundreds of stars on creation day.

| Repo | Created (UTC, 11-03) | star / fork(11-05) | 11-06 |
|---|---|---|---|
| StormSkinkGrip/game-ping-multipath-router | 16:37 | 336 / 67 | Still live |
| Chipwithinflash/watson-AI-osint-all-in-one | 16:40 | 576 / 85 | 404 |
| Pyramidriseize/ai-fursuit-pattern-generator | 16:41 | 159 / 10 | Still live |
| Hubamongrescue/hearthstone-battlegrounds-tracker | 16:44 | 157 / 12 | Still live |
| brightsongwrath/personal-data-deletor-osint | 16:47 | 647 / 113 | 404 |
| megan3047/Microsoft-365-For-Windows | 17:02 | 95 / 10 | 404 |
| DolphinBridge36/game-server-route-racer | 17:03 | 278 / 23 | Still live |
| PatchBuilderAmplify/stolen-crypto-tracer | 17:08 | 405 / 44 | Still live |
| SkinkSmelter6/valorant-fps-lag-fixer | 17:13 | 284 / 20 | Still live |

The topics run from OSINT and game boosters to Hearthstone card trackers, Valorant stutter fixes, and "stolen crypto tracing" or "free Office," all aimed at people willing to run an exe to save time.

Take apart a sibling repo that's still alive (game-ping-multipath-router) and the method is identical: the README is polished, with badges, screenshots, and copy like "Honest first." The core is a zip in Releases: "unzip, run Main.exe, no install, no admin rights." The repo was created 11-03, but commit dates are backdated to 10-08, 10-18, 10-25, 10-30, and the commit messages are template lines like "core: the engine, the rules and the main module." The forking accounts are auto-generated GitHub-format throwaways (things like `mariyaislam790769-boop` and `khantahmid507-wq`), clustered into forks during a few hours around 11-05 in the early morning. The stargazers list won't load.

So that good-looking 15% fork-to-star ratio isn't "lots of people building on it." It's a fingerprint of bought traffic, since real projects usually have much lower fork ratios.

This tactic has a name. BleepingComputer reported on FakeGit in Jul 21: 7,600 GitHub repos delivering the SmartLoader → StealC infostealer, with 14M+ cumulative downloads, marked by convincing READMEs and fake stars and forks. It came back in Oct 8, involving 17,610 repos, and changed download links in 13k READMEs within 34 hours. Watson's batch ships an Electron portable.exe, unlike the LuaJIT-plus-`.cmd` launchers common to FakeGit, so it may not be the same group. The specific trojan inside the exe hasn't been confirmed, since no sample was obtained. As for the money: based on public research into similar campaigns, the likely model is stealing browser passwords, login cookies, and crypto wallets, then cashing out or selling access.

### Why pick OSINT as the topic

Because the need is real. Open-source tools for finding which sites a username has accounts on are well established (star counts as of 11-06):

| Project | Start | star | Barrier |
|---|---|---|---|
| Sherlock | 2018 | About 98k | Command line, needs Python |
| Maigret | 2020 | About 40k | Claims 3,000+ sites, command line; has a standalone exe but still runs in a terminal |
| SpiderFoot | 2012 | About 24k | Automation platform with a web UI |
| holehe | 2020 | About 16k | Checks which sites an email is registered on, command line |
| Blackbird | 2022 | About 9.8k | Username / email, with a web UI |
| WhatsMyName | 2015 | About 3k | Search directly in the browser |

Watson's "3,100+ sources" very likely borrows Maigret's number (inference). Its pitch, "double-click on Windows, no terminal, one input box," lands squarely on ordinary people who want to check a seller, a recruiter, or themselves but can't get Python installed. It's a good bait, not a real product.

### What it means for you

If you're looking for "which projects are gaining stars lately" to decide what to build next, this batch is a trap set for you. They aren't buying stars to fool you directly; they're gaming trending charts, aggregator sites, and auto-repost accounts. The vaishantsah version made HotRepo's new-projects chart, got reposted by @Dinosn, and was also shared by a security news account on Facebook. The next stop is AI search: security firm Island calls this "AgentBaiting," where bait repos get into AI directories and trend sites and are then recommended by AI assistants as legitimate projects.

A few signals that screen them out at a glance: the account is new and has only one repo; it has hundreds of stars within 72 hours of creation; the description is "Free … for Windows / no terminal / no account"; the README's core action is downloading an exe or zip, and it teaches you to dismiss SmartScreen; commit dates predate the repo creation date; the stargazers list won't load; and a batch of repos with the same tone appears in the same hour.

### If it were you

**In one line** : stay away. The stars are fake, the code is empty, there's nothing to borrow, and building on it is building malware.

**Who it fits** : no one. The only thing worth taking away is a real gap, "no-terminal footprint search," but that isn't new either. Sherlock already has desktop and Android versions with installers (Nwokike/Sherlock, offering a Windows installer, Linux packages, and an APK), and Blackbird, SpiderFoot, and WhatsMyName all have web interfaces.

**If you still want to build a star-earning project in this space** : do the things Watson promised and didn't. The program you ship should be the source itself (CI builds directly from public code, with checksums), signed, available for both Windows and Mac, and built on Maigret's or Sherlock's site lists directly instead of a self-declared "3,100+." Put "you don't need to click Run anyway" on the first screen of the README. Get users the legitimate way: answer "how do I install this on Windows" questions in the Sherlock and Maigret issue trackers, and submit to r/OSINT, Bellingcat's tool lists, and awesome-osint-style lists.

**Is there a window** : no rush. This isn't a window-type opportunity. The bait batches get re-uploaded from new accounts every few days, and real products win on being auditable and trustworthy, so shipping a week earlier or later makes little difference.

**What would show this read is wrong** : if security researchers later obtain Watson's exe and show it's a clean, working query tool, then it's just a real product with a very dubious promotion tactic, and this write-up's verdict would need to change. As of Nov 6, nothing points that way.

[GitHub repo ↗](https://github.com/Chipwithinflash/watson-AI-osint-all-in-one)

**Research notes: competitor table, acquisition evidence, full research report**

Competitors

| Name | Where | Launched | Scale | How it differs from this one |
|---|---|---|---|---|
| Sherlock | Open source | 2018-12 | About 98K stars on GitHub | Actually works but needs the command line; Watson claims "double-click and go," but the code is mock data |
| Maigret | Open source | 2020-06 | About 40k stars, claims 3000+ sites | Watson's "3100+ sources" very likely borrowed this number; Maigret is open source and auditable, while Watson ships an exe with no visible source |
| Blackbird | Open source | 2022-05 | About 9.8k stars | A real username/email lookup tool with a web UI |
| holehe | Open source | 2020-06 | About 16k stars | Checks which sites an email is registered on, command line |
| SpiderFoot | Open source | 2012 | About 24k stars | Automated OSINT platform with a web UI |
| WhatsMyName | Web | 2015 | About 3k stars, has a web version | Search directly on the web, no exe download |
| Epieos / OSINT Industries | Web | Not verified | Commercial service | Legitimate paid web service |

Where users come from

- **Verified** **Buying stars and forks to push new repos up charts and aggregator sites** : 200–600 stars on creation day; the fork accounts are auto-generated throwaways that forked in a concentrated burst within hours (sibling repo StormSkinkGrip can be checked); the stargazers endpoint is 404; a predecessor lost 45 stars in a single day

- **Verified** **Automatic reposting by aggregators and security news accounts** : indexed by HotRepo; reposted by @Dinosn on 2026-10-29; posted by Facebook's ThreatVector

- **Verified** **Keyword SEO and standalone landing sites** : keywords like OSINT/AI/free/Windows/3100+ sources; watsonfind.icu serves the exe via /api/download

- **Verified** **Bulk account rotation to flood the space** : 11-03 16:37–17:13, a batch of one-off accounts created more than a dozen "Free … for Windows" repos; forged commit dates predate the repo creation time

## Chipwithinflash/watson-AI-osint-all-in-one: not a product that grew organically, but a star-farmed malware bait repo

> Bottom line: this is not a product that "took off." Every signal points to it being a batch-deployed GitHub lure repo for Windows malware: a throwaway account, stars and forks padded to look real, a README that walks users to a portable.exe and tells them to click past the SmartScreen warning, and search that is mock data. The earlier repo under the same name was deleted, then re-uploaded from a new account. By 2026-11-06 both the repo and the account were 404. The 576 stars and 85 forks on the data card reflect no real demand.

### 1. Data card and current status

- Data card (github repo census, 2026-11-05): created 2026-11-03 16:40 UTC, 576 stars, 85 forks. The account Chipwithinflash has only this repo. Electron + TypeScript. Description: "Free OSINT search tool for Windows. 3100+ sources, one field, no terminal."

- 2026-11-06 checked with `gh api repos/Chipwithinflash/watson-AI-osint-all-in-one` and `gh api users/Chipwithinflash`. Both returned 404: the repo and the account are gone (either GitHub suspended them or the author deleted them).

### 2. Same-name "predecessor": vaishantsah/watson-AI-osint-all-in-one

- Our github database (repo_profile / repo_day) has a same-name repo, vaishantsah/watson-AI-osint-all-in-one, created 2026-10-28 00:09. That account also has only 1 repo(s), and it was linked to the site watsonfind.icu.

- Star curve (repo_day): 10-28 was 208 (creation day, no exposure before that), then 10-29 356, then 10-30 311 (a drop of 45, typical of GitHub purging fake stars), then 11-01 360, then 11-02 358. No records after that. Today `gh api` returns 404.

- The next day (11-03) a same-name repo from Chipwithinflash appeared with nearly the same description. Deleting the first one and re-uploading from a new account is standard practice for malicious repo operations.

- HotRepo indexed a page for the vaishantsah version ([hotrepo.ai/vaishantsah/watson-AI-osint-all-in-one](https://hotrepo.ai/vaishantsah/watson-AI-osint-all-in-one），转述的)). Its summary of the README points:
    - Download `Watson-1.6.0-portable.exe`, from Releases or the "Download" button on watsonfind.icu (the site serves the exe via `/api/download`).
    - If Windows SmartScreen blocks it, click "More info → Run anyway." The stated reason: "we haven't bought a code signing certificate yet."
    - "The query implementation isn't visible in the README. `src/data/mock.ts` contains only sample data, and `searchProfiles()` is an interface stub." In other words, the open-source code has no real search capability at all. Users actually run an exe whose source they can't see.

- X security aggregator @Dinosn (Nicolas Krassas, who auto-reposts new GitHub security tools) 2026-10-29 reposted the vaishantsah version, and @ShadowHackrs replied underneath: "its a virus dont share this" ([x.com/Dinosn/status/2115792247619019214](https://x.com/Dinosn/status/2115792247619019214）)).

- The Facebook page ThreatVector also posted an intro, a typical auto-repost from a security news account.

### 3. Sibling repos from the same batch: factory-style deployment

In the github repo_profile data, during the two hours 2026-11-03 16:00–18:00 UTC, a batch of repos appeared. Each had a new account with only 1 repo, a description like "Free … for Windows, local, no account," and several hundred stars on creation day. The account names are random word combinations:

| Repo | Created (UTC) | Stars/forks (repo) | 11-06 status |
|---|---|---|---|
| StormSkinkGrip/game-ping-multipath-router | 16:37 | 336/67 | Present, 341/67 |
| Chipwithinflash/watson-AI-osint-all-in-one | 16:40 | 576/85 | 404 |
| Pyramidriseize/ai-fursuit-pattern-generator | 16:41 | 159/10 | Present |
| Hubamongrescue/hearthstone-battlegrounds-tracker | 16:44 | 157/12 | Present |
| brightsongwrath/personal-data-deletor-osint | 16:47 | 647/113 | 404 |
| megan3047/Microsoft-365-For-Windows | 17:02 | 95/10 | 404 |
| DolphinBridge36/game-server-route-racer | 17:03 | 278/23 | Present |
| PatchBuilderAmplify/stolen-crypto-tracer | 17:08 | 405/44 | Present |
| SkinkSmelter6/valorant-fps-lag-fixer | 17:13 | 284/20 | Present |

Take apart a sibling that's still up, StormSkinkGrip/game-ping-multipath-router, and the playbook is identical:

- The README is polished (badges, screenshots, copy like "Honest first"). The actual download is `game-ping-multipath-router.zip` in Releases, with "unzip and run Main.exe, no install, no admin rights."

- The commit history is **fabricated** . The repo was created 11-03, but commit dates are backdated to 10-08, 10-18, 10-25, 10-30. Commit messages follow a template like "core: the engine, the rules and the main module."

- The fork accounts are throwaway accounts with GitHub-auto-generated-looking names (`mariyaislam790769-boop`, `khantahmid507-wq`, `dipd28709-ctrl`, `dorami9897-a11y`, and so on), clustered into forks within a few hours in the early morning 11-05.

- The stargazers endpoint returns 404 (PatchBuilderAmplify is the same).

Other OSINT lures with the same theme: ArcSwordKiln/osint-people-checker (created 10-30, "3,400+ public sources… Runs on your PC," 157 stars, account also has only 1 repo) and brightsongwrath/personal-data-deletor-osint ("Ask 970 data brokers to delete your data," already 404).

### 4. Background: the 2026 FakeGit / "lure factory" campaign

- BleepingComputer, 2026-07-21: FakeGit used 7,600 GitHub repos to deliver SmartLoader → StealC infostealer, with 14M+ cumulative downloads. The repos shared traits: persuasive READMEs, fake stars and forks, and copied project descriptions ([www.bleepingcomputer.com/news/security/fakegit-campaign-uses…](https://www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/）)).

- BleepingComputer 2026-10-08 / Apiiro: FakeGit 10-04 reactivated, hitting 17,610 repos and editing the download links in 13k READMEs within 34 hours ([www.bleepingcomputer.com/news/security/fakegit-malware-campa…](https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/）). Broadcom's protection bulletin also covers it ([www.broadcom.com/support/security-center/protection-bulletin…](https://www.broadcom.com/support/security-center/protection-bulletin/fakegit-infrastructure-re-armed-in-large-scale-repointing-campaign）).

- Island (https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware) proposed "AgentBaiting": these lure repos get into AI directories and trend aggregators, where AI agents recommend them as legitimate projects.

- TRUV.IS's roundup ([tti.truv.is/reports/TT-20261011-83-fakegit-github-readme-lur…](https://tti.truv.is/reports/TT-20261011-83-fakegit-github-readme-lures-luajit-smartloader-stealc.html）提到，Netskope)) names one of the crews "TroyDen's Lure Factory."

- A caveat: FakeGit's typical payload is a LuaJIT + `.cmd` launcher, while this Watson batch uses Electron portable.exe / Main.exe. They may not be the same crew. I have not obtained a Watson exe sample, so **which malware family it belongs to is unverified** . But the combination of a throwaway account, bought stars and forks, fabricated commit history, guidance to bypass SmartScreen, an empty open-source shell, and re-uploading from a new account after deletion is enough to classify it as malicious lure.

### 5. Competitors (the category it impersonates)

It impersonates the category of "footprint search by username, email, or phone number." Real products include:

- Sherlock (open source, 2018, about 98k stars on GitHub): a command-line tool that checks usernames across hundreds of sites.

- Maigret (open source, 2020, about 40k stars): claims 3,000+ sites. Watson's "3,100+ sources" very likely borrows this number.

- Blackbird (open source, 2022, about 9.8k stars): username and email lookup with a web UI.

- holehe (open source, 2020, about 16k stars): checks which sites an email address is registered on.

- WhatsMyName (open source, 2015, about 3k stars): a site list, with a web version you can use directly.

- SpiderFoot (open source, 2012, about 24k stars): an automated OSINT platform with a web UI.

- Commercial web services: Epieos, OSINT Industries, and assorted people-search sites.

(Star counts were checked by 2026-11-06 with gh api.) Watson's claimed differentiator is "double-click to run on Windows, no terminal, one input field." That hits a real pain point: non-technical users who want Sherlock or Maigret but can't install Python. It is a strong **lure pitch** , not a product capability that exists (the code is mock data).

### 6. Growth tactics breakdown (the lure's "distribution playbook")

1. **Padding stars and forks to climb new-repo charts and aggregators** : 200–600 stars on creation day, with an unusually high fork-to-star ratio (15%). The fork accounts have GitHub-auto-style usernames and forked within a few hours. The goal is not real human interest. It is to get trend aggregators (HotRepo, githubtree, and our own recall), security news auto-repost accounts (@Dinosn, ThreatVector), and AI search to treat it as a hot new tool. HotRepo has been confirmed to index it, and @Dinosn retweeted it.

2. **Riding hot categories and keywords** : OSINT, "AI," "free," "no terminal," "Windows," plus a Maigret-tier "3,100+ sources" number. This feeds SEO and GitHub search.

3. **Standalone landing site watsonfind.icu** (.icu is a cheap TLD). Downloads go through the site's own `/api/download`, so the code on GitHub and the exe users actually get are separate, and the payload can be swapped at any time.

4. **Delete and re-upload from a new account** : 10-28 vaishantsah → 11-03 Chipwithinflash. The same batch spreads across a dozen-plus themes at once: OSINT, game boosters, Hearthstone card trackers, Valorant stutter fixes, stolen-crypto tracing, Office piracy, and more.

5. **Where the money comes from** (inferred from public research on similar campaigns; this specific sample is unverified): stealing browser credentials, session cookies, and crypto wallets, then monetizing or reselling them. Themes like "stolen-crypto-tracer" and "Solana drainer" target users who hold crypto directly.

### 7. Visibility and copycats

- Security people have already called it out (the X reply "its a virus"). GitHub has removed two same-name repos. Campaigns like FakeGit have been widely covered by BleepingComputer, Island, Apiiro, and Broadcom. This specific repo has not been covered by media on its own.

- The "copycats" are just its own clones and sibling repos (the predecessor of vaishantsah, ArcSwordKiln/osint-people-checker, brightsongwrath/personal-data-deletor-osint). No legitimate product is following it.

### 8. What this means for our recall

- This set of signals can be used directly as a malicious-bait filter rule: the account has only 1 repos and is very new; the repo gets more than 150 stars within 72 hours of creation; the description reads "Free … for Windows / local / no account / no terminal"; the README has a Releases button to download an exe/zip or instructions for bypassing SmartScreen; commit dates are earlier than the repo creation date; the stargazers API returns 404; and a batch of similar accounts create repos within the same hour. The scoring rationale from this recall, "fork/star 15% shows willingness to try and build on it," is backwards: a high fork ratio is a sign of inflation.

- The need itself is real: a "Sherlock/Maigret desktop version that doesn't require a terminal" (Sherlock has 98k stars, and non-technical users can't get Python running). Here it's just being used as bait. A legitimate, signed, open-source, auditable Windows/Mac footprint-search tool can be evaluated as an opportunity on its own, but there's nothing in this repo worth borrowing.

### Unconfirmed

- We didn't obtain samples, so the specific Trojan family behind the Watson exe, the C2, and whether anyone was infected are unverified.

- Unclear whether Chipwithinflash was taken down by GitHub or deleted by its owner.

- Unverified whether it's the same group as FakeGit.

This article was written by AI from public data and the data we collect daily. Numbers are sourced, and inferences are labeled.