codomposer

Also reported as: Lucas Lee

A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, codomposer. The attribution is theirs, not this site's.

The remainder was read by this site from the account itself and is cited to the page and date it was read.

IT Worker Fraud First reported 2026-04-17 · last reported 2026-09-20

Identifiers attributed to this persona

7 indicators the sources below record for this operator, each with its sources.

IndicatorTypeAccount status
codomposer alias —
Lucas Lee alias —
akileus0902@gmail.com email address —
eugenechiudev@gmail.com email address —
https://github.com/codomposer github profile live checked 2026-09-30
https://github.com/gitakileus github profile removed checked 2026-09-30
https://gitlab.com/gitakileus gitlab account live checked 2026-11-08

codomposer

alias IT Worker Fraud CURATED

First seen 2026-09-20 · last seen 2026-09-20

Sources

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under gitakileus, a login the index already carries for this persona on another platform. The profile gives a member-since date of 27 June 2022. It displays the name Lucas Lee, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/gitakileus — Chollima Hunter · under “codomposer / Lucas Lee” · pulled 2026-09-13
  • Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/codomposer, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: akileus0902@gmail.com authored 169 commits across 16 of its repositories, commits as "codomposer"; eugene.chiu.dev@gmail.com authored 42 commits across the repository codomposer/polymeme-app, commits as "codomposer". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
    github.com/codomposer — Chollima Hunter · under “codomposer” · pulled 2026-09-20

Lucas Lee

alias IT Worker Fraud CURATED

Also listed under Lucas Lee — this value’s page names all of them.

First seen 2026-10-03 · last seen 2026-10-03

Sources

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under gitakileus, a login the index already carries for this persona on another platform. The profile gives a member-since date of 27 June 2022. It displays the name Lucas Lee, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/gitakileus — Chollima Hunter · under “codomposer / Lucas Lee” · pulled 2026-09-13
  • Confirmed by Chollima Hunter research and rated medium confidence; corroborated by i3 Threat Advisory: email indicator appendix, DTEX Systems. Chollima Hunter research records an applicant presenting as Lucas Lee with the addresses lucaslee0224@gmail.com and magicdev325@gmail.com, a Montreal number on the résumé and a second, Ontario number given as the contact for the work laptop. lucaslee0224@gmail.com is in DTEX's i3 Threat Advisory email-indicator appendix, which this site already indexes, a match Chollima Hunter research also recorded. The research also recorded lucaslee.netlify.app as the applicant's portfolio; read on 3 October 2026, that site belongs to a developer in South Korea under a different full name, with its own address, telephone number and a GitHub account dating from 2018, so it is either borrowed or unrelated and is deliberately not carried here. Neither magicdev325@gmail.com nor the telephone numbers appear in any source this site holds. A separate laptop contact number is the arrangement seen in laptop-farm cases; where the laptop was shipped is not recorded here.
    chollimahunter.github.io/remote-workers/ — Chollima Hunter · under “Lucas Lee” · pulled 2026-10-03

akileus0902@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-20 · last seen 2026-09-20

Source

  • Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/codomposer, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: akileus0902@gmail.com authored 169 commits across 16 of its repositories, commits as "codomposer"; eugene.chiu.dev@gmail.com authored 42 commits across the repository codomposer/polymeme-app, commits as "codomposer". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
    github.com/codomposer — Chollima Hunter · under “codomposer” · pulled 2026-09-20

eugenechiudev@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-20 · last seen 2026-09-20

Source

  • Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/codomposer, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The addresses recorded here were not already in this index: akileus0902@gmail.com authored 169 commits across 16 of its repositories, commits as "codomposer"; eugene.chiu.dev@gmail.com authored 42 commits across the repository codomposer/polymeme-app, commits as "codomposer". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
    github.com/codomposer — Chollima Hunter · under “codomposer” · pulled 2026-09-20

https://github.com/codomposer

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Previously gitakileus; created 11 March 2022 in the March batch. Post ten credits it with six merged pull requests to langgenius/dify and an open one to bitcoinjs-lib. No address is given for it.
    x.com/meow_mfer/status/2045107378249720221 — meow mfer (@meow_mfer) · under “codomposer” · published 2026-04-17 · pulled 2026-08-30

https://github.com/gitakileus

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Previously gitakileus; created 11 March 2022 in the March batch. Post ten credits it with six merged pull requests to langgenius/dify and an open one to bitcoinjs-lib. No address is given for it.
    x.com/meow_mfer/status/2045108306914726034 — meow mfer (@meow_mfer) · under “codomposer” · published 2026-04-17 · pulled 2026-08-30

https://gitlab.com/gitakileus

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

  • Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under gitakileus, a login the index already carries for this persona on another platform. The profile gives a member-since date of 27 June 2022. It displays the name Lucas Lee, which no source this site holds had attached to this operator before. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
    gitlab.com/gitakileus — Chollima Hunter · under “codomposer / Lucas Lee” · pulled 2026-09-13

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. codomposer as the name of the operator is the cited researcher’s assertion, repeated here as their claim.