https://github.com/starmaster1126
https://github.com/starmaster1126 is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-09-20.
github profile IT Worker Fraud CURATED live
live
Source
-
github.com/starmaster1126 is GitHub account id 52027648, created on 20 June 2019, and is a different account from github.com/starmastar1126, which is id 67782634 and which this index already holds under "Accounts tied to the mr.new0509 address by email reuse". The two handles differ by one letter, starmastER against starmastAR, and both end in 1126. The link is the display name rather than the handle. Walking the repositories of starmastar1126 on 19 September 2026 recovers 50 commits authored by 52027648+starmaster1126@users.noreply.github.com under the name Silas Jo. The same repositories carry two commits from 67782634+ministar1126@users.noreply.github.com, also under the name Silas Jo, and that address belongs to the held account itself: GitHub mints a noreply address from the account's immutable numeric id, and 67782634 is starmastar1126 under a former handle. The candidate therefore commits under a name the held account uses of itself, which is the test this index applies to separate a holder's own second identity from the upstream author of a repository that was copied in. Two further details agree with that reading without being relied on for it. The profile name on starmaster1126 is StarMaster DevGenius, against the StarMastar DevGenius that the held account signs its own commits with, again one letter apart. And both of the candidate's public repositories were created and last pushed on 21 October 2019, the same-day pattern that separates these accounts from ordinary ones. What is not filed here is worth recording too. github.com/dylanwilliams1126, account id 170390436, also commits into starmastar1126 and its address dylanwilliams1126@gmail.com appears in that account's history, but it does so once and under its own name rather than one the held account uses. One commit under an unshared name is what an ordinary contributor looks like, so it is left out. The same applies to the other accounts a ranking pass surfaced on 20 September 2026: committing into a held account's repository is how that pass selected them in the first place and is not evidence of anything on its own. The account was live when read on 20 September 2026. No persona is attached, because the group it joins carries none.
github.com/starmaster1126 — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.