Not a bug report, sorry for the noise, but I figured you'd want to know.
I came across Fourty4Four/XStoreUnlocker while looking for this tool and something felt off, so I dug into it. It's your repo, your commit history, your GPL license, but with a trojan zip added and the README rewritten.
What they added: src/X-Store-Unlocker-v1.8.zip (547 KB). Inside:
application.cmd, 24 bytes, contents are literally start luau.exe ico64.txtluau.exe, which Defender quarantined on extraction before I could inspect it, flagged as Trojan:Win64/Lazy.PGPK!MTBico64.txt, 308 KB of obfuscated Luau on a single line
So the whole "installer" is a .cmd that feeds an obfuscated script to an interpreter. There's no installer and no GUI in there, despite what their README claims.
zip SHA256: 80eb50ab7ef18d97361f1e2edee2aee2acf558d45bf93ff5bf10ea8711839e1e
How they set it up. They only made three commits on top of your history:
eb565b7 adds the zipc027864 rewrites the README (111 lines changed)7f8ec66 tweaks the README links
Everything else is untouched, same commit hashes as yours. Notably it isn't a fork (fork: false, no parent), they re-pushed your history into an existing empty repo, so there's no "forked from Zephkek/XStoreUnlocker" banner and no link back to you. The repo was created 2025-11-21, months before yours existed, which fits a dormant account repurposed later. Your source code is basically working as camouflage to make the download look trustworthy.
The README is the giveaway once you read it. Every download link and badge points at that in-repo zip while the text says it's linking to a releases page. It tells people to disable their antivirus, twice. And it claims the tool "does not collect or send your data anywhere."
I'm reporting it to GitHub for malware. Mentioning it here because you have an angle I don't: they stripped your attribution while keeping your GPLv3 code, so a DMCA takedown from you would probably move faster than an abuse report from a random user.
Nothing wrong with your actual code by the way. I went through it before trusting any of this and it does exactly what it says. No network calls, no registry writes, nothing written outside the game folder. The compiled DLL in your v2.1.0 release backs that up too, its import table is only KERNEL32 and the MSVC runtime, so no winhttp/wininet/ws2_32/advapi32 at all.
Not a bug report, sorry for the noise, but I figured you'd want to know.
I came across
Fourty4Four/XStoreUnlockerwhile looking for this tool and something felt off, so I dug into it. It's your repo, your commit history, your GPL license, but with a trojan zip added and the README rewritten.What they added:
src/X-Store-Unlocker-v1.8.zip(547 KB). Inside:application.cmd, 24 bytes, contents are literallystart luau.exe ico64.txtluau.exe, which Defender quarantined on extraction before I could inspect it, flagged asTrojan:Win64/Lazy.PGPK!MTBico64.txt, 308 KB of obfuscated Luau on a single lineSo the whole "installer" is a .cmd that feeds an obfuscated script to an interpreter. There's no installer and no GUI in there, despite what their README claims.
zip SHA256:
80eb50ab7ef18d97361f1e2edee2aee2acf558d45bf93ff5bf10ea8711839e1eHow they set it up. They only made three commits on top of your history:
eb565b7adds the zipc027864rewrites the README (111 lines changed)7f8ec66tweaks the README linksEverything else is untouched, same commit hashes as yours. Notably it isn't a fork (
fork: false, no parent), they re-pushed your history into an existing empty repo, so there's no "forked from Zephkek/XStoreUnlocker" banner and no link back to you. The repo was created 2025-11-21, months before yours existed, which fits a dormant account repurposed later. Your source code is basically working as camouflage to make the download look trustworthy.The README is the giveaway once you read it. Every download link and badge points at that in-repo zip while the text says it's linking to a releases page. It tells people to disable their antivirus, twice. And it claims the tool "does not collect or send your data anywhere."
I'm reporting it to GitHub for malware. Mentioning it here because you have an angle I don't: they stripped your attribution while keeping your GPLv3 code, so a DMCA takedown from you would probably move faster than an abuse report from a random user.
Nothing wrong with your actual code by the way. I went through it before trusting any of this and it does exactly what it says. No network calls, no registry writes, nothing written outside the game folder. The compiled DLL in your v2.1.0 release backs that up too, its import table is only KERNEL32 and the MSVC runtime, so no winhttp/wininet/ws2_32/advapi32 at all.