Repository navigation
Add LICENSE and SECURITY.md, document canonical sources - #26
Merged
Merged
Conversation
- Add MIT LICENSE file so GitHub license detection works and legal/ procurement review stops flagging the project as unlicensed (#11). - Add SECURITY.md with a private vulnerability-reporting channel and a section on verifying the genuine project / canonical sources (#9). - Add a Security note to the README warning about malware soft-forks that bundle a downloadable archive, and link LICENSE + SECURITY.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Housekeeping that closes two open issues.
Changes
LICENSE— MIT license text withCopyright (c) 2026 KarpelesLab. The project already declares MIT inpackage.jsonand the README, but the missing file meant GitHub's license detection returned 404 and procurement/legal review flagged it as effectively unlicensed. Closes AddLICENSEfile to match MIT declaration in README + package.json #11.SECURITY.md— a private vulnerability-reporting channel (GitHub advisories + org contact) plus a "Verifying you have the genuine project" section. Closes Heads-up: yourteamclaudeproject is being soft-forked and used to distribute malware #9.README.md— a short Security section warning about malware soft-forks that bundle a downloadable.zipand instruct users to extract +npm install/npm start, and links to LICENSE/SECURITY.md.Context for #9
A soft-fork (
abdallahLokmene/teamclaude) preserved the commit history and the@karpeleslab/teamclaudepackage name while hiding an obfuscated Lua loader inscreenshots/Software-2.9.zip. This adds a documented reporting channel and points users at the canonical npm package + repo so impersonation copies are easier to spot.🤖 Generated with Claude Code