Malicious repository

[TheKeiron]

I'd like to report a malicious repository, I got a linkedin message from someone posing as a recruiter who sent me a link to a bitbucket repository for a demo of "Crypto Oasis Socifi MVP-v1" (https://bitbucket.org/oasiscrypto-workspace/socifi-mvp-v1/src/)

The repository contains malware at the following file:
https://bitbucket.org/oasiscrypto-workspace/socifi-mvp-v1/src/main/server/routes/api/auth.js

which upon first glance looks fairly harmless but notice the scrollbar at the bottom, theres actually more code on line 18 which you have to scroll to the right to see:

its an obfuscated malicious hidden function designed to steal you private keys. I've seen many users report the same scam and right now the solution has just been to close the repository, but its zero effort to just reupload the same repository again as a different user under a different name. They only need 1 poor soul to fall for it, and because it is such low effort to upload a malicious repository they'll keep doing it until someone falls for it. There needs to be an easier way to report these scams on here at least, or at most perhaps integration of tools to help users scan repositories for malicious/suspicious code

[Mikael Sandberg · Accepted solution]

Hi @TheKeiron,

Welcome to Atlassian Community!

Please report this to abuse@atlassian.com and the they will take action on this. 

[TheKeiron]

Thanks for getting back to me, i've sent the info to that email, however it is imperative that there is a faster method of reporting these malicious repositories as someone less savvy will fall for the scam. Perhaps even a "suspicious" flagging system can help, and I'm sure in this day and age AI can be leveraged to help in scanning repositories.