He-Song Cui

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".

Found on 17 September 2026 by asking Keybase whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 10 March 2023 and no display name but the handle itself. The profile carries a signed proof claiming the GitHub account jsreputation. A Keybase proof is a statement posted to the other account and signed by this one, so it evidences that whoever held this login also held that account at the time it was posted. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 17 September 2026 by asking Docker Hub whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 23 October 2017. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/uripandada is account id 99074029, created on 5 February 2022, display name Ash Palania, location Russia. All 100 of its own commits in GitHub's search are signed uripandada@gmail.com, an address Narcass3 gives for He-Song Cui, and two commits in its repositories are signed jsreputation@gmail.com, another address the researcher gives for the persona. github.com/MachineLearningMike also commits heavily with an address on the same entry, fleetpro@gmail.com, but that address belongs to the paper co-author the researcher did not name as the worker, and that account is not filed.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".

Found on 17 September 2026 by asking Docker Hub whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 23 October 2017. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/uripandada is account id 99074029, created on 5 February 2022, display name Ash Palania, location Russia. All 100 of its own commits in GitHub's search are signed uripandada@gmail.com, an address Narcass3 gives for He-Song Cui, and two commits in its repositories are signed jsreputation@gmail.com, another address the researcher gives for the persona. github.com/MachineLearningMike also commits heavily with an address on the same entry, fleetpro@gmail.com, but that address belongs to the paper co-author the researcher did not name as the worker, and that account is not filed.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/uripandada is account id 99074029, created on 5 February 2022, display name Ash Palania, location Russia. All 100 of its own commits in GitHub's search are signed uripandada@gmail.com, an address Narcass3 gives for He-Song Cui, and two commits in its repositories are signed jsreputation@gmail.com, another address the researcher gives for the persona. github.com/MachineLearningMike also commits heavily with an address on the same entry, fleetpro@gmail.com, but that address belongs to the paper co-author the researcher did not name as the worker, and that account is not filed.

The first cited post states that the identity has claimed to be a Malaysian fullstack developer living in Kuala Lumpur, and separately to be in Khabarovsk and in Moscow, and that it appears as a named author on an academic paper. The accounts are listed in the second post, which is a reply in the same thread. The paper page also names a co-author, Chun-Hu Cui at fleetpro@gmail.com; that address is recorded because it co-authored the fabricated paper the post exposes, though the post names He-Song Cui rather than Chun-Hu Cui as the DPRK worker.

Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".

Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/uripandada is account id 99074029, created on 5 February 2022, display name Ash Palania, location Russia. All 100 of its own commits in GitHub's search are signed uripandada@gmail.com, an address Narcass3 gives for He-Song Cui, and two commits in its repositories are signed jsreputation@gmail.com, another address the researcher gives for the persona. github.com/MachineLearningMike also commits heavily with an address on the same entry, fleetpro@gmail.com, but that address belongs to the paper co-author the researcher did not name as the worker, and that account is not filed.

Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".

Found on 17 September 2026 by asking Keybase whether an account exists under ashpala, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 10 March 2023 and no display name but the handle itself. The profile carries a signed proof claiming the GitHub account jsreputation. A Keybase proof is a statement posted to the other account and signed by this one, so it evidences that whoever held this login also held that account at the time it was posted. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.

Found on 12 September 2026 by probing the platforms an operator usually reuses a login on, for the handles this site already holds, and read directly from the page cited. The DEV Community account is the richest single page found for this operator: it presents as Ash Pala, joined 14 December 2021, claims "Full-stack developer with 7 years of experience since 2013" with Solidity and Hardhat among the skills, gives the location as Moscow, Russia, and publishes three of its own contact points — the address jsreputation@gmail.com, which this site already held, the GitHub account of the same name, and an about.me page under the slug urichoi. Both names it ties together, Ash Pala and Uri Choi, are names the reporting already files this operator under, which is what makes the page corroboration rather than a new lead. The dev.to account answers on the handle ashpala and on jsreputation, the older login. The GitLab account under jsreputation is a member since 11 March 2022 and states nothing but the display name "JS Reputation".