https://github.com/goldsunshines
https://github.com/goldsunshines is a GitHub account
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Seongsu Park (@unpacker) and Heiner García.
The earliest of those reports is dated 2025-02-26 and the most recent 2025-08-04.
The reporting files it under the persona Shiny Girl, alongside 4 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud RESEARCHER POST live
live
Sources
-
Published as a reply to a @browsercookies post. The researcher calls the identity highly suspicious on the grounds that it claims degrees from Canada and Germany and work in Spain, Denmark, Germany and the United States twice, almost all of it remote. Transcribed by hand from the screenshot published in the cited post, read at full resolution rather than from a thumbnail. The screenshot shows the display name Shiny Girl over the GitHub handle goldsunshines, a bio reading "Backend, automation, bot dev", and 534 followers against 700 following.
x.com/unpacker/status/1952279863920132490 — Seongsu Park (@unpacker) -
Heiner García's article names a network of GitHub accounts it calls the SuperStar Campaign, after the words Super, Star and Dev that recur in the handles and a SuperStar user name on one member's machine, and places it with the Contagious Interview and Wagemole activity Unit 42 reports. The network centres on Finalgoal231, a GitHub organisation of eighteen members, most of which the article judges to be fake profiles, whose discussions show members starring one another's work, coordinating through Discord and rewriting commit histories to change addresses. It shows popstar7 renaming oddcommitking to Luis96920 in a pull request, and xaramore, a follower hub from the researcher's earlier work, now deleted. The first thirty-two accounts are the article's own closing list of suspicious accounts, less the two held back below, and the article describes that list as a sample of a larger confidential set; the last four, xaramore, Finalgoal231, oddcommitking and e-nitram, are named in its body. When read on 24 September 2026, deepsea514, GoodLuck0129 and xaramore no longer resolved, and kingp08 and Topstar88 resolved to accounts created in April 2026 and July 2025, after the article, so those two handles now belong to different holders than the ones it named.
www.linkedin.com/pulse/reviewing-activity-github-accounts-linked-dprk-heiner-garc%C3%ADa-p%C3%A9rez-xpkae/ — Heiner García
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2024-09-06 |
|---|---|
| Repositories | 7 original, 8 forked |
| History older than the account | 7 repositories: Finalgoal231/mui-nextjs-admin (first commit 2023-12-21), Finalgoal231/finalgoal-svelte-ecommerce (first commit 2022-09-21), iOS-Touch-simulate (first commit 2020-07-19), power-bi-world-cup-2022 (first commit 2023-01-22), shop-backend-supabase (first commit 2023-02-16) |
| Commits copied into others' repositories | 0 |
| Commit identities | 1 address, 7 names; up to 7 names on one address |
Commit addresses this index holds
Follows these indexed accounts
Followed by these indexed accounts
Related indicators
Same persona record: Shiny Girl
Cited by the same report: x.com/unpacker/status/1952279863920132490
All 4 indicators from this source