Edit4: Sorry, False Alarm: https://any.run/malware-trends/amadey/

    IP addresses
    185.199.108.133
    Hostname: cdn-185-199-111-133.github.com.

https://dnschecker.org/reverse-dns.php?query=185.199.111.133

---

Virus Total: Activity related to AMADEY - according to source Cluster25 - 6 months ago This DOMAIN is used by AMADEY. Amadey is a botnet agent that appeared around October 2018 sold on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server. It can also load other payloads to the victims' devices.

macOS download url after downloading with librewolf and rightclicking "copy downoload url": https://www.virustotal.com/gui/url/f1e08a34d17fd85cd8896ba86...

Edit: i dont get this when copying direct links from the readme.md. Its just when i click them and copy the url it used to download.

Edit2: i get this too when i download the x64 exe and copy the download link from the librewolf (firefox fork) download manager https://www.virustotal.com/gui/url-analysis/u-6a55e124c22f9b...

Edit3: maybe false alarm and the botnet used the github url https://release-assets.githubusercontent.com/ to spread malware?

Show HN: Free open source Adobe Lightroom alternative, completely local with AI