Malicious clones of your open-source repository: protecting maintainers and the people who install
Attackers copy popular repositories, add malware and promote the copies with similar names and fake stars. A practical guide for maintainers and users: how fake clones and repojacking work, how to make the real project verifiable with signed releases and provenance, and what to check before installing.