https://github.com/everythinguwannatobe

https://github.com/everythinguwannatobe is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2026-09-21.

The reporting files it under the persona Spencer Duncan, alongside 5 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-21 · last seen 2026-09-21

Source

  • Read on 21 September 2026 by walking the commit history of every repository on github.com/everythinguwannatobe, an account reached because its Next.js_swap repository is byte for byte the one the account filed under ZEUS holds. The ZEUS-DEV-919 working document, from which this persona is transcribed, gives one address for Spencer Duncan, timdonerpower@gmail.com, and this account signs 1,948 commits with it, under the names TimDoner, spencerduncanpower and its own login. A second address, spencerduncanpower@gmail.com, signs 702 more under the account's own login and is recorded here as the same holder's: it is the persona's name as a mailbox, used on the same account beside the address the document published. github.com/spencerduncanpower also exists as an account, created on 3 March 2023 with no public repositories, and a third login, nicholasduncanpower, is attributed two commits in these repositories. The account was created on 29 October 2022, holds 57 repositories of which 17 were created on 30 October 2023, and its profile reads Senior Software Engineer under the display name BE THE BEST BEST!. Its Next.js_swap was created on 29 October 2022 with 13 commits signed TimDoner; the ZEUS account's copy was created on 16 January 2023 and its oldest commit is dated 1 December 2022, so the code moved from this persona to that one. Two personas holding one another's code is recorded as a link between the entries, not as one hand.
    github.com/everythinguwannatobe — Chollima Hunter · under “Spencer Duncan” · pulled 2026-09-21

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2022-10-29
Repositories57 original, 0 forked
History older than the account49 repositories: animal-farm-nodejs (first commit 2021-02-10), APIcasso (first commit 2018-07-15), blog_app (first commit 2022-02-01), chain (first commit 2018-04-09), clean-architecture-swiftui (first commit 2019-12-18)
Commits copied into others' repositories0
Commit identities6 addresses, 17 names; up to 16 names on one address; up to 9 addresses under one name

Commit addresses this index holds

Follows these indexed accounts

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-02. 4 other commit addresses are held for review rather than listed. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: Spencer Duncan

Other identifiers the reporting files under the same persona; 4 of 5 are shown.

All 5 on the Spencer Duncan page

Cited by the same report: github.com/everythinguwannatobe

Chollima Hunter lists 3 other indicators in this source. 1 are shown, chosen across types.

All 4 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.