`https://github.com/codomposer`

https://github.com/codomposer is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from meow mfer (@meow_mfer). The report is dated 2026-04-17.

The reporting files it under the persona codomposer, alongside 6 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Previously gitakileus; created 11 March 2022 in the March batch. Post ten credits it with six merged pull requests to langgenius/dify and an open one to bitcoinjs-lib. No address is given for it.
x.com/meow_mfer/status/2045107378249720221 — meow mfer (@meow_mfer) · under “codomposer” · published 2026-04-17 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2022-03-11
Repositories	117 original, 143 forked
History older than the account	11 repositories: `-E-Commerce-Site` (first commit 2020-12-31), `budget_app` (first commit 2021-12-20), `dao-voting-app` (first commit 2022-02-07), `Django-Poll-App` (first commit 2019-01-19), `Front-end-Developer-Interview-Questions` (first commit 2020-01-21)
Commits copied into others' repositories	0
Commit identities	2 addresses, 7 names; up to 4 names on one address; up to 2 addresses under one name

Commit addresses this index holds

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-01. 1 other commit address is held for review rather than listed. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: codomposer

Other identifiers the reporting files under the same persona.

Cited by the same report: x.com/meow_mfer/status/2045107378249720221

meow mfer (@meow_mfer) lists 6 other indicators in this source.