ImpostorDocket

Who it's for

Small paid Windows/macOS/Linux software vendors and OSS maintainers whose installer or app name is impersonated; today they cope with manual screenshots, GitHub search, VirusTotal, and the GitHub abuse form.

The problem

Time: hours collecting hashes, screenshots, and release artifacts. Legal: abuse/trademark reports are delayed or rejected without timestamped evidence. Payment: fake installers or license pages can cause refunds, chargebacks, and support storms.

How to build it

Self-hosted web UI plus CLI: paste a public repo or download-page URL, it captures/clones, hashes, scans artifacts, produces a ZIP/PDF evidence packet, and exports a GitHub abuse/registrar form; optional daily watch for one app name across GitHub, npm, PyPI, and domains.

How it makes money

Indie vendors pay $99 per docket or $49/month per watched app because a single malware-imposter support/refund incident costs more than that, and free manual reporting does not produce the timestamped, hash-linked packet.

Why it doesn't exist yet

Incumbents skip it because GitHub's incentive is process rather than evidence collection, and enterprise brand-protection suites are too expensive and sales-led; an indie can ship a fixed-price self-serve evidence kit for one or a few app names.

First users

The first 10 can come from developers named in the 'GitHub has not removed malicious imitation software' discussion and indie vendors posting about clones on HN or Indie Hackers, offered a free first docket.

Build size

1-2 people x 8 weeks; includes capture, clone, SHA-256 manifest, YARA/ClamAV scan, timestamped report, abuse template, and one-brand watch; excludes legal filing, dynamic malware sandboxing, and broad web brand monitoring.

Biggest risk

GitHub or a major registry ships a verified abuse intake that automatically captures artifact hashes and fast-tracks trademark reports, making the third-party packet unnecessary.

Conditions for a hit (all 3 required)

• Given a public GitHub repo URL, outputs an evidence ZIP within 15 minutes containing page/repo capture, git commit id, SHA-256 manifest of files, and an RFC 3161 timestamp token.
• For each release/installer artifact under 500 MB, lists file path, SHA-256, size, and ClamAV/YARA detections or a clean flag in the report without requiring command-line forensics.
• Generates a single PDF/HTML abuse packet with pre-filled original URL, infringing URL, rights-owner fields, hash table, capture time, and copy-paste sections for GitHub abuse or registrar trademark reports.

How it's judged (in 6 months)

GitHub repository reaches 1,000 stars, or a Product Hunt launch of the service reaches daily top 5.(judgment date 2027-03-28)

AI self-confidence 47/100 — self-reported likelihood of meeting the criterion, not a business success rate