## Investigation: `samwalker37/plasmate-cdp-v8-engine` ### What the Repository Claims to Be The README describes **Plasmate v0.5** as a "cross-platform browser engine for AI agents and automation workflows" built on **Chrome DevTools Protocol (CDP)** and **V8 JavaScript engine**. It claims to support: - Headless & headed modes - Multi-tab orchestration - DOM manipulation & event simulation - AI agent integration - Cross-platform (Windows, macOS, Linux) - 100% HTML/JS (single-file) ### What It Actually Is This repository is **not a real browser engine**. It is a **suspicious, obfuscated, auto-generated repository** with the hallmarks of a **GitHub activity farm, spam repository, or credential-harvesting / SEO-poisoning project**. Here is the evidence: #### 1. Obfuscated Payload (`index.html`) The only code file is a **single-line, heavily obfuscated HTML/JS file**. It uses: - `atob()` (base64 decoding) - Character-code manipulation (`charCodeAt`, `fromCharCode`) - String-splitting and reassembly This is a classic pattern for hiding a payload — often a **redirector, a tracker, a crypto miner, or a phishing page**. The file is deliberately unreadable to evade casual inspection. #### 2. Auto-Generated Commit History All **39 commits** follow a rigid, machine-generated naming pattern: ``` stabilize-build-98071 refresh-build-28619 fix-improve-30018 release-update-37184 optimize-refresh-45810 enhance-deploy-42399 sync-optimize-8466 ``` Each commit message is a verb-noun pair followed by a random 5-digit number. No human would name commits this way. #### 3. The Only Real Change: A Log File Every single commit does **exactly one thing**: appends a line to `.github/update-log` with a timestamp, a `run=` ID, and an `n=` value. For example: ``` 2026-07-10T19:23:03Z run=42006 n=98321 2026-07-10T20:06:56Z run=12443 n=961270 ... 2026-07-11T20:19:26Z run=46358 n=14356 ``` The timestamps span from **2026-07-10T19:23:03Z to 2026-07-11T20:19:26Z** — the latest entry is just **2 minutes before I accessed the repo**. This is a **heartbeat log** from an automated script or bot. #### 4. No Real Code Changes The `index.html` file has never changed across all 39 commits. The repository is a **shell** — a single obfuscated HTML file plus a constantly-growing log file. No browser engine code, no CDP implementation, no V8 integration exists. #### 5. Suspicious Timing & Activity Pattern - The repo was created on **July 10, 2026** and has already accumulated **39 commits in ~25 hours**. - Commits are happening at a rate of ~1.5 per hour, around the clock. - The `n=` values in the log are large, seemingly random numbers (98321, 961270, 274533, 143560) — possibly session IDs, counter values, or exfiltrated data. ### Why It Matters This repository is a **live example of a GitHub-based automated spam / botnet infrastructure**: - **GitHub as a C2 channel**: The repository acts as a **command-and-control heartbeat log**. A bot somewhere writes a timestamp and a run ID to this repo every time it executes. Anyone monitoring the repo can see if the bot is alive. - **Obfuscated payload delivery**: The `index.html` could be served via GitHub Pages to deliver malware, a phishing page, or a crypto miner to unsuspecting visitors. - **SEO poisoning / reputation farming**: The README uses trendy keywords ("AI agents", "browser engine", "CDP", "V8", "automation") to attract search traffic and appear legitimate. The account (`samwalker37`) may be building a "credible" open-source profile for future social engineering. - **Automated commit farming**: The commit activity inflates the account's contribution graph, making it look like an active, legitimate developer. ### Strongest Sources (from the investigation) | Source | What it shows | |---|---| | **Commit `337647e`** (initial commit) | The very first commit created the `.github/update-log` with `2026-07-10T19:23:03Z run=42006 n=98321` — the heartbeat log was the *first* thing created. | | **Commit `1558be4`** (latest, "stabilize-build-98071") | The most recent commit added `2026-07-11T20:19:26Z run=46358 n=14356` — the bot was active 2 minutes before investigation. | | **Commit `6a94ae2`** ("update-release-22847") | Shows the second entry in the log, confirming the pattern: each commit appends exactly one line. | | **`index.html` raw content** | The raw file is a single line of obfuscated JavaScript using `atob()` and character-code manipulation — no browser engine code exists. | | **Commit message pattern** | All 39 commits follow the machine-generated `verb-noun-XXXXX` pattern, proving automation. | ### Verdict **This is not a browser engine. It is an automated bot/spam repository using GitHub as a C2 logging channel.** The "Plasmate CDP V8 Engine" branding is a facade. The real purpose is likely one or more of: botnet heartbeat logging, payload delivery via obfuscated HTML, GitHub contribution farming, or SEO poisoning. **Do not run the `index.html` file** — it should be treated as a potential security threat.