https://github.com/lionguru

https://github.com/lionguru is a GitHub account that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2026-09-28.

github profile Contagious Interview CURATED live checked 2026-09-30

First seen 2026-09-28 · last seen 2026-09-28

Source

  • Abstract Security's report lists every author address with a commit in a malicious repository. Because the lures are forks of real projects, that table mixes the operators who wrote the lures with the developers whose code was copied, and each address was checked on 28 September 2026 before its owner was carried. These are the addresses whose commits run through many different people's technical-assessment and test-task repositories, which is where a lure author's commits land when candidates fork the lure; GitHub credits them to the accounts below. goldenfinix68 holds alexandersmir68@outlook.com (16); Alexcox8 holds alexcox052595@gmail.com (38); lionguru holds arielmonster99@gmail.com (168); Funkedup007 holds chaley@gmail.com (70); codehome0301 holds myselfmail0301@gmail.com (847); Skillverifier834 holds suportemtng@gmail.com (7); ironforgedevspace holds maqsoodssyasirss@gmail.com (5); ironforgecoplace holds michalk001126@gmail.com (2); viacheslavdanilov889-blip holds viacheslavdanilov889@gmail.com (5). The addresses that belong to the copied projects' own developers are held back. Source: https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector
    github.com/goldenfinix68 — Chollima Hunter · under “Accounts owning the lure-author addresses in Abstract Security's commit table (Contagious Interview)” · pulled 2026-09-28

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: github.com/goldenfinix68

Chollima Hunter lists 8 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.