On the night the original author deleted the repo, two people announced at once that they were taking over. One shipped a backdoor, the other picked up 1,268 stars

ARTEX is a Chinese AI automated pentesting platform. After it was used to attack South Korean banks, the author took it closed-source and deleted the repo in Oct 2026 8. People who wanted it suddenly had nowhere to go but copies. RuoJi6/ARTEX was created the next morning as a "continuously maintained" version and reached 28 stars in 1,268 days. It didn't write ARTEX itself. It won the competition among copies: it was alive, still updating, and its releases could be traced back to a source. Below: how this wave of traffic landed on it, and whether you can follow the same path.

The day of Oct 8

At UTC 10:50, ARTEX author Autumn-27 pinned a statement on the GitHub profile: the tool had been abused, it would go closed-source, and no new releases would come. The repo was then taken down, and when checked on 11-06 it was still 404.

ARTEX launched at the end of July, branded as "champion project of the Baidu agent+ attack-defense challenge": a single-file Go program with a web console, where several LLM agents divide the work of collecting assets, running scanning tools, finding vulnerabilities, writing reports, and retesting. The author had previously built the asset-mapping tool ScopeSentry (2,290 stars). On Oct 7, CrowdStrike disclosed that attackers had used ARTEX plus DeepSeek against South Korean banks including Shinhan, KB Kookmin, and Hana. Later, Microsoft, Zscaler, and CrowdStrike reported on a North Korean group, a China-linked group (11 days, 14 countries, 200+ institutions), and another group uncovered by Seoul police. Mainstream outlets like The Straits Times and SBS covered it.

Everyone's covering a tool that can "make money on its own" by depositing into your bank, and the original just became unavailable. On X, someone wrote 10-09: "I wanted to study the ARTEX source code, but the original repo was taken down and closed-sourced. The only thing I can find is a backup repo of v0.3.15."

That night at 18:50, a new Docker Hub account tomicdd was registered. 19:41 it pushed an ARTEX image. Within an hour, the GitHub account trhhubsd uploaded an ARTEX source copy with a single line changed: docker-compose pointed to that image. When security researcher Badbyte later took it apart, they found that the login endpoint of the image contained a function. If the captcha field began with a certain password, whatever followed would execute as root, and this happened before password verification.

About 4 hours later (UTC 10-09 00:56), RuoJi6 created their own repo with a one-line description: "Autumn-27/ARTEX continuously maintained open-source version."

Forty-plus "ARTEX" copies, and where the stars ended up

As of 11-04, the copy-tracking site artex.sh listed 47 copies worth a look (not counting thousands of empty clones), grouped into maintained forks, translations, mirrors, backups, custom variants, and rewrites. The main ones:

Star counts come from GitHub daily records, 11-06. For deleted repos, the last observed count is used.

RuoJi6's star count didn't look good at first. 10-10 had only 47 stars, gaining a dozen or two a day the week before, with the traffic going to the earliest and most "verbatim" copy, mhtsec. Then rivals dropped out one by one, and its curve stepped upward:

• 10-17 mhtsec disappears. RuoJi6's daily gains went from 15–30 up to 35–65. The original was stuck at v0.3.15, buggy, and its one-click update pulled packages from the original author's Releases, which stopped working after the deletion. By then people wanted more than a backup. They wanted a version that would keep getting updated.
• 11-04 backdoor exposed. Badbyte 11-04 posted that 62 public consoles were running a version with a backdoor, and the backdoored image was pulled nearly 8,000 times. trhhubsd deleted the repo right away, and Docker 11-05 pulled two of the backdoored images. RuoJi6 has been up 47, 66, 102, and 76 over these days, with the single-day peak at +102 11-05. 11-06 In The Hacker News report, RuoJi6/ARTEX is one of the three named copies, and the other two can no longer be downloaded.

Forks stand at 764, about six-tenths of the star count. That looks abnormal, but it's typical for this kind of repo: mhtsec has more forks than stars (150%), and Hinln is at 139%. People fear another deletion, so they fork as a backup.

Beyond stars, a few numbers show people are actually using it (11-06): on Docker Hub, ruoji6/artex has been pulled 22,428 times (including repeat pulls and automation, so not a user count). The installers for the last three versions were each downloaded 1,164 to 2,175 times. Issues and PRs include outside users asking for an English UI and submitting fixes.

What it got right: visible provenance

The same night, trhhubsd and RuoJi6 both said the same thing: "I'm the maintained version." The difference is entirely in the first paragraph of the README:

Preserves the original commit history of Autumn-27/ARTEX and the AGPL-3.0 license. Program release packages are downloaded from this repo's Releases; the Docker image ruoji6/artex is built and published by this repo's GitHub Actions.

Concretely, it did these things:

• Keeps the original history and license. Anyone can check which lines it changed from the original.
• Releases are verifiable. Each version ships with a SHA256SUMS checksum file, and the image is built by the repo's own Actions, not pushed from someone's laptop.
• An online demo that only runs fake data. Deployed on Vercel with NEXT_PUBLIC_MOCK=1. It doesn't scan and needs no model key, and it updates automatically with each official release. People who don't want to install it can click in and look at the interface first.
• 更新快。 4 周 262 次提交,发到 v0.3.27,仓库里一堆 codex/ 开头的分支,看得出是用 AI 编码代理在高频修小问题(推断)。还修掉了未登录接口暴露 ARTEX 特征的问题。

Normally nobody cares about any of this. But once someone installs a copy and gets a root shell, "who built this image" becomes the first question everyone asks before downloading. RuoJi6 happened to be the copy among the remaining ones that answered that question most clearly.

The author also has some credentials: 507 followers, plus two security tools with a thousand-plus stars each (CACM at 1,134 stars, audit-skills at 1,043 stars). They also built AegisHook, which adds approval gates to agent tool calls, and AgentMirror, a honeypot for catching red-team pentest agents. The approval-detail component in ARTEX was carried over from AegisHook.

Where users come from

I found no big account that specifically recommended it. Its stars mostly came from the step where people search "ARTEX → open the fork list → pick one that works."

Its weak spots

The code belongs to someone else. Multi-agent pentesting, ScopeSentry asset sync, and the full Chinese console were all built by the original author. RuoJi6 only decides where it ranks among the forks; the demand itself came from the deletion. Once the hype fades, that demand fades with it.

The subject carries real risk. The tool has already been used by at least four groups of attackers against financial institutions, and India's CERT-In named it in its November advisory. Nobody knows whether the original author will pursue these forks or whether GitHub will clean them up. I also haven't verified why mhtsec was removed: self-deleted, taken down after complaints, or removed by the platform.

The numbers don't fully add up. trhhubsd 11-01 lost over a thousand stars in a single day. The cause is unverified, so we can't rule out fake-star activity between the forks.

If it were you

D. Look into it, but don't chase this one. The "maintained fork" slot for ARTEX is already held by someone, there are over forty forks in the space, and the window closed within two weeks of the deletion. Much of the demand also comes from the notoriety of "it can break into a bank yourself," which isn't a subject worth building your reputation on. What you can take away is a position few people take seriously: the successor to a popular project after it gets deleted or stops being maintained.

• Good fit for: developers already active in an open-source ecosystem, who can read large project code and ship releases solo every day. Some existing reputation in the community helps, since the successor role runs on trust.
• Bad fit for: anyone who wants to take over ARTEX or other tools used for attacks (you'd get the stars, but the risk and reputation are yours); anyone who only wants to host a backup (backups catch the first wave, and a week later nobody looks); anyone with only a few hours a week.
• How to do it: watch for popular repos that suddenly get taken down, stop being maintained, or switch to closed source, usually accompanied by an author statement, a license dispute, or an acquisition. Create the repo within 24 hours, keep the full commit history and original license, and write a one-line description along the lines of "continued maintained fork." In the first week, fix the most painful broken thing in the original (this time, the broken auto-update). Then use Actions to build release packages and images, attach checksums, ship a demo that runs only on fake data, and put "where this came from, and how to verify it" in the first paragraph of the README.
• How to get stars: first, get fork directories, awesome lists, and aggregator sites to list you as the "maintained fork," which is the biggest traffic source. Second, turn user requests (this time, English UI and assorted fixes) into a release within a day so the issue tracker looks actively managed. Third, when a similar incident happens (poisoning, abandonment, deletion), your verifiable releases are ready-made news. Proactively email the security researchers or media covering it.
• When to be early: create the repo within the first 48 hours after the original goes down, and become the most actively updated option within two weeks. RuoJi6 started less than a day late, and it only held on because rivals dropped out one by one.
• Signs you read it wrong: ① GitHub or the original author begins mass-removing ARTEX forks, and RuoJi6 is taken down too. That would mean successor projects can drop to zero at any time, and only worth building when the original project's subject is clean. ② A month after the backdoor incident, RuoJi6's daily gains fall back to a dozen stars, meaning successors only ride a one-time event and the long tail can't sustain them. ③ The reverse: if it keeps gaining dozens of stars a day after the hype fades and external PRs keep growing, the maintained fork is really becoming the new mainline, and the next one is worth starting even earlier.