PSA / security: fake "OpenMontage-app" installer repo circulating — this project ships NO binaries

Summary

Heads-up for users and the maintainer — a SECOND fake-installer org is circulating under this project's name.

https://github.com/OpenMontage-app/OpenMontage (org OpenMontage-app, created ~2026-08-27) copies this project's name and description (relabeled MIT), has 2 commits, and its README pushes platform "installers" via its releases path: OpenMontage-x64.7z / OpenMontage-x64.exe, OpenMontage-Linux-x64.run, OpenMontage-macOS-arm64.dmg. GitHub topic bait (openmontage-installer, install-openmontage, openmontage-gui) steers searchers toward it.

This looks like wave two of the campaign documented in #200: that issue names org Open-Montage (hyphenated), whose identically named OpenMontage-x64.7z was executed by the reporter and flagged as Trojan:MSIL/PureRat.ABA!MTB — Pastebin-staged payloads, dropped executables, registry persistence. We have not executed the OpenMontage-app binaries, but the org, artifact names and lure are the same pattern.

Ground truth from this repo: install is git clone + make setup only, and there are zero releases and zero binaries — anything prebuilt under this name is unofficial by construction.

We reported OpenMontage-app/OpenMontage to GitHub Trust & Safety today under "Active Malware or Exploits". Posting here so people searching for an installer find a warning.

Suggestion: with two lookalike orgs in three months, a pinned security notice or a README line ("there is no installer — we ship no binaries") would inoculate future users.

Operating system

n/a — security advisory, not a runtime bug

Pipeline

n/a

Runtime / renderer

n/a

Steps to reproduce

1. Search GitHub for an OpenMontage installer
2. Land on OpenMontage-app/OpenMontage offering .7z/.exe/.run/.dmg "installers"
3. This repo has zero releases — treat those binaries as hostile

Expected behavior

Searching GitHub for an OpenMontage installer leads only to this repository, whose install path is git clone + make setup — no binaries exist.

Actual behavior

A lookalike org (OpenMontage-app) distributes unofficial platform binaries under this project's name; users may run them believing they are official.

Relevant logs or error output