200,000-star REA maliciously impersonated: fake installation package flagged as malware, downloaded 172 times

Beating AI News Flash: The viral AI reverse-engineering tool REA has been maliciously impersonated. On October 13, a developer issued a warning on REA's official GitHub repository, stating that someone had created a fake repository offering a Windows installer package suspected of containing a Trojan. REA's GitHub Stars have recently surpassed 200,000, and the fake installer package had reached 172 downloads by the time it was reported.

The impersonator registered a GitHub repository named `rea-tools/rea`, which closely resembles REA's official website `rea.tools`, and directly copied the official README. They added a "Windows Standalone Version" download link to the original description, providing an 82.6 MB compressed archive. The reporter's inspection found that Microsoft Defender flagged the archive and its executable file as the Wacatac Trojan, and 8 out of 45 security engines on VirusTotal reported it as malicious. Sandbox analysis also revealed suspicious behaviors in the file, including detection of debugging environments and delayed execution.

REA maintainers subsequently merged a fix PR on October 13, adding a download source warning to the official README, reminding users to obtain the software through the official GitHub repository, official website, or npm. Currently, the reported fake repository is no longer accessible.