Pub-dev: Fake package with copied code, and license violation.

Created on 13 Aug 2020 · 4Comments · Source: dart-lang/pub-dev

Okay, I know that this is not the appropriate place to request package removal, however, after my law firm and I contacted pub.dev via email [email protected], we didn't get a response to something that Is it urgent.
A scammer is posing as one of Flutter's most popular packages today, Getx. He copied the entire source code of version 1.11.0 of the package, took advantage of the fact that there was no package with the name "getx" (previously my package name was Get, and due to SEO it was changed to Getx 2 months ago ), and recently sent that package.
All labels are fakes, and used to give an air of credibility to the package, to pass itself off as the original.
Many people are downloading this package, it has 58% popularity and 7 likes.
It is not known what its purpose is, it is probably a package scam that will insert some malicious code in the future.
Getx is a verified publisher.
I am the creator of the package that has been in pub.dev for almost 1 year
I am the copyright holder of the Getx brand.
I am the owner of the domain Getx.site which the package was verified on.
Although the community has been alerted, there are dozens of videos on youtube talking about "getx", and novice users are downloading the package by mistake.

Its is original package:
https://pub.dev/packages/get
Screen Capture_select-area_20200813115757

its is fake package
https://pub.dev/packages/getx
Screen Capture_select-area_20200813115908

Its is original package
Screen Capture_select-area_20200813120016

Its is a fake package
Screen Capture_select-area_20200813115954

Source

jonataslaw

👍37 🚀9 👀8

Most helpful comment

Something must be done urgently.
The responsible is acting with bad intentions.
This can harm the real package in tangible and intagible ways.

kauemurakami on 13 Aug 2020

👍16 🚀6 ❤6

All 4 comments

Something must be done urgently.
The responsible is acting with bad intentions.
This can harm the real package in tangible and intagible ways.

kauemurakami on 13 Aug 2020

👍16 🚀6 ❤6

If pub.dev continues to allow this kind of behavior, we will have a messier community than npm itself, where there are multiple duplicate packages and little moderation.

Not to mention, the content legal ownership issue is being directly inflicted, which is still deliberate deceptive plagiarism so that new users are easily fooled.

It's clear that the bundle clone's intent is to outshine GetX's growth and quality!

It is now the duty of the pub.dev administration to punish the person directly responsible (probably the clone of the package was published with a fake account ...), making sure that it does not violate the terms and does not mislead any member of the community. Only then can we trust the quality of the packages published here!

We are waiting for a clear answer on this matter!

GuiHS01 on 13 Aug 2020

👍5

Dart product manager here: We received the support ticket for this earlier today, and will process it carefully. It's been less than half a business day since we received it, and legal matters take time. If the pub.dev policy was violated, we will act on it.

As legal discussions are not appropriate to discuss and handle here in our technical issue tracker, so I will be closing and locking this issue.