https://github.com/swan1213
https://github.com/swan1213 is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-09-21.
github profile IT Worker Fraud CURATED live
live
Source
-
Read on 21 September 2026. The repository-provenance pass over the held GitHub accounts found 216 accounts outside the index whose zero-star repositories are byte-for-byte copies of a held account's, or the other way round; a commit walk over them, compared against the addresses the index already holds, produced these. Each signs the bulk of its own commits with an address that a published list names as a DPRK IT-worker mailbox, and none of those addresses had an account attached until now. Where the list is The Raven File's August 2025 compilation the address arrives with no persona, so the accounts are filed together here rather than under names. github.com/revoltig4sg, id 134444531, created 23 May 2023, company SoftMansion Tech, 1,176 followers against 1,355 followed, signs 1,748 commits thomasj0830@gmail.com, mostly under the name codemaster05330, which five noreply addresses carrying the account id show to be its former handle; it has re-signed the 3,509-commit history of the open-source asset tracker snipe-it as its own, and its Python-Media-Player is nine tenths the tree on the account filed under Chae Gwang Jin. github.com/dybbuk-dev, id 100238707, created 22 February 2022, 605 followers against 1,550 followed, signs 543 commits dybbuk555@gmail.com under the names dybbuk555 and luckyman3559, and was itself named dybbuk555, per the noreply addresses; twelve of those commits sit in the profile repository of the account filed under Wu Long, whose Veychi-store it holds an identical copy of. github.com/prowebdev119, id 88698125, created 10 August 2021, bio reading snowvalley.all@gmail.com and company invokable GmbH, signs 539 commits tieosong119@gmail.com under the names prowebdev110 and prowebdev119, and sixteen more under devking1205@gmail.com; its react-chatting-app is the tree the ZEUS account holds. github.com/Typhon0130, id 125342474, created 14 February 2023, company RaptorX, signs 167 commits crystalmaster0130@gmail.com under the names Typhon and Minato0130, and its fanse-frontend is the ZEUS account's. Three commits in its Progressive-app are signed swan21213@gmail.com and attributed by GitHub to github.com/swan1213, created 27 March 2024, which means that address is registered to that account; its own ten repositories are signed with a differently named mailbox that is not repeated here because it may be a real person's. github.com/luckylightcodes, id 104870236, created 3 May 2022, display name Lucky Code and formerly nicolas-north per its noreply addresses, signs five commits jupiter.softdev@gmail.com under that former handle and six under nicolasnorth.tech@gmail.com; jupiter.softdev is on tayvano's IT-worker list and the second address is the handle as a mailbox, so both are carried. Its Linconstore-Admin is the ZEUS account's. Three accounts the same walk reached were at first left out because the list address on them did not look like their own: loveFeynman, kingpig-dev and ranupthestairs held repositories carrying commits by vigorousdevelopment524@gmail.com and juliegibbs206@gmail.com, which by itself says an operator's repository was copied, not that the holder is one. A second look on 24 September 2026 settled two of them. loveFeynman turned out to have worked in the same repositories as the Eric Liu persona at the time, and is filed under "GitHub accounts working in the same repositories as the Eric Liu persona". github.com/kingpig-dev, id 132079829, created 28 April 2023, is added here: its SGHEDA repository was created on 4 August 2023, and three of the commits it received that month are signed juliegibbs206@gmail.com under the author name kingpig-dev, the account's own login, among 67 that month under rowelyle9@gmail.com and the account's noreply address. juliegibbs206@gmail.com is on The Raven File's list; GitHub now attributes those commits to github.com/juliegibbs206, an account created on 31 October 2024 with no repositories, which is to say the address was registered to an account more than a year after it signed kingpig-dev's work. kingpig-dev signs its own commits rowelyle9@gmail.com, which is carried with it. It follows SuperVenus0725, loveFeynman and sheriff-rango. ranupthestairs, created 27 September 2024, remains a lead only: its copy of SGHEDA was created on 30 September 2024 and carries kingpig-dev's history, and no commit dated after the account's creation is signed with kingpig-dev's address, so what it shows is a copy.
github.com/swan1213 — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.