https://github.com/jsreputation
https://github.com/jsreputation is a GitHub account
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Narcass3 (@Narcass3) and Chollima Hunter.
The reports are dated 2026-07-30.
The reporting files it under the persona He-Song Cui, alongside 15 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud CURATED live
live
Sources
-
The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.
x.com/Narcass3/status/2082696714754969630 — Narcass3 (@Narcass3) -
Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".
dev.to/ashpala — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2020-02-02 |
|---|---|
| Repositories | 33 original, 0 forked |
| History older than the account | 0 repositories |
| Commits copied into others' repositories | 0 |
| Commit identities | 1 address, 4 names; up to 4 names on one address |
Commit addresses this index holds
Related indicators
Same persona record: He-Song Cui
All 15 on the He-Song Cui page