https://github.com/devstar9981
https://github.com/devstar9981 is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter.
The report is dated 2026-09-18.
The reporting files it under the persona Rui Jin, alongside 13 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud CURATED live
live
Source
-
Read on 18 September 2026. The cluster opened inside another entry: JCRhyle/portfolio, a repository on one of the two GitHub accounts this site holds for Jemelito Constantino, carries four commits, two authored JCRhyle <jemelitoconstantino@gmail.com> and two authored ruijindev0801 <ruijin.developer@outlook.com>. That login and that address belong to neither account named in the Jemelito entry, and a commit address inside a repository is a value rather than a shared name or a shared handle, which is why this entry stands beside that one rather than inside it. The GitHub account ruijindev0801 was created on 5 November 2024, displays the name Rui Jin, gives its location as REMOTE, states ruijin.developer@gmail.com as its public address and ruijin-ai-dev0801.vercel.app as its site, and on the day it was read had 150 followers against 151 followed. A second account, devstar9981, created on 6 April 2026, displays the same name, states ruijin.dev0801@gmail.com and links the same portfolio; two of its six repositories are named Linkedin_Scraper and Github_Scraper_2026. The order in which the two were filled is worth recording. devstar9981 took its repositories between 9 and 21 April 2026, beginning with Linkedin_Scraper four days after the account existed; ruijindev0801, which had carried nothing for the seventeen months since it was registered, then took all eight of its repositories on 24 and 25 April 2026, seven of them original and one a fork, among them Job_Seeker, Agent_Claude and a second copy of Github_Scraper_2026. Commit metadata across the two accounts is signed under six addresses and three committer names, ruijindev0801, Rui Jin and Rui0801, and the two addresses carrying the great majority of the commits, expertbot0801@gmail.com and luckyjerry861@gmail.com, bear no relation to the name the accounts display. The portfolio is what joins the accounts to the LinkedIn profile, and it does so by link rather than by name: it prints github.com/ruijindev0801, github.com/Rui0801, linkedin.com/in/rui-jin-319400434 and the X account ruijin9981, and offers two contact addresses, ruijin.ai.dev@outlook.com and ruijin.developer@gmail.com. The Rui0801 login it links returns GitHub's does-not-exist page, although commits under that committer name remain in both accounts' histories. The same page prints five certificates, each with a credential identifier, AWSD-9K4M-2P7X against Amazon and META-FE-8T2R-5LQ1 against Meta among them, whose View Credential links resolve to the certificate programme's own marketing page rather than to any verification record, and it still carries an unedited template placeholder, a link to yourwebsite.com. The identity publishes two employment histories that cover the same years and name no employer in common. The portfolio gives Hong Kong and the United States: an internship at an unnamed technology startup from June 2018 to August 2019, volunteer web development for an unnamed non-profit from September 2019 to May 2020, freelance development through Upwork from June 2020 to December 2022, and prompt engineering at Outlier.ai from July 2022 to January 2026. The LinkedIn account gives Moscow, Russia: Freelancer.com from 2020 to 2022, DataAnnotation from July 2022 to January 2024, Bittensor from February 2024 to April 2026, and a Snorkel AI contract from May 2026. The two agree on nothing but a Bachelor of Computer Science at City University of Hong Kong from 2016 to 2020. The account carries no verification, and LinkedIn dates it to September 2026, the month it was read and six years after the earliest work either history claims. Nothing here establishes who holds these accounts. The entry records what they state, and what links them is in each case a value one of them publishes, a commit address or a portfolio link, rather than the name they share.
github.com/devstar9981 — Chollima Hunter
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2026-04-06 |
|---|---|
| Repositories | 6 original, 0 forked |
| History older than the account | 0 repositories |
| Commits copied into others' repositories | 2 |
| Commit identities | 1 address, 1 name |
| Name then four digits | devstar9981 |