This is the first time I'm posting anything here but I figured this may be the right audience.

I've never run into something like this and I don't quite know what to make of it. I'm the author and maintainer of libgpiod. The official git repository is the one at kernel.org[1]. There's also a github mirror[2] as well as a documentation page[3] at readthedocs that I maintain.

I noticed (purely by chance) that there's a new website at libgpiod.com that's been created recently. I have nothing to do with it. It's clearly AI-generated but it redirects to my github. It's a 2 month old domain, anonymized registrar, protected by Cloudflare and NeoProtect and a Swedish host behind that.

Clearly someone went to great lengths to stay anonymous. I'm afraid of falling victim to some new elaborate supply chain attack. What should I do about it (if anything)? Has anyone else experienced something similar?

[1] https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/
[2] https://github.com/brgl/libgpiod
[3] https://libgpiod.readthedocs.io/
Libgpiod - Modern C Library for Linux GPIO Hardware Control

Libgpiod is a modern C library for Linux GPIO control, enabling efficient hardware access for embedded and system developers. #Libgpiod

Libgpiod
@brgl I'm reasonably certain that the people who've developed these sites are in India. A couple of them appear to have compromised their systems with credential stealing malware recently. But I don't see anything remotely malicious or phishy in their saved credentials or visited sites. If they were in the habit of doing bad things online, it would almost certainly be evident in their keylog data. However, they appear to be creating a large number of unrelated sites that basically just use SEO to get people to click on their affiliate links and buy stuff at Amazon, etc.
@briankrebs @brgl dude just did an adhoc threat hunt and analysis like nbd and i demand to know this workflow, krebs 😆
@emory @brgl Heh. Just lots of practice, I guess. Also access to a lot of different threat hunting platforms, so...