A mysterious user simply named “O” has been found creating identically named repositories (O) on dozens of Git hosting sites. Affected administrators report that after allowing open registration, an account “O” suddenly appeared and pushed a huge repository (often several gigabytes) into a brand-new project also named “O”reddit.com. In one case a server admin discovered that “O” had registered and uploaded a 4.3 GB repo on their Gitea (Forgejo) instance, apparently forked from gitea.lolumi.com/O/Oreddit.com. Further investigation uncovered the same /O/O repo structure on many domains (for example, git.pack.house/O/O, dagshub.com/O/O and others)reddit.com. In each case the content and layout are almost identical: enormous repos of bizarre content with the user and project both named “O”.
For example, one affected user reported on reddit that their Forgejo instance was “hacked” by the user O, who “somehow managed to activate their account” and then “uploaded a massive 4.3 GB repository” under O/Oreddit.com. They later found a network of /O/O repos on pack.house, dagshub.com, etc., all matching this same patternreddit.com.
In every case the repository name is O (or multiple capital O’s) and the account name is O. One server owner noted that the accounts even use a spoof email like OOOO@…. (The HackerspaceWiki entry for “O” indeed lists an email OOOO@…mail.be and a homepage linking to archive.today/…OOOOO.carrd.co in Belarusooooooooooooooooooooooooooo.carrd.co.)
An example avatar from one of the “O” repositories: a simple white disc (black circle in the center), reflecting the “O” motif. This same circular logo appears in commits and avatars for the O/O repos. (Screenshot from Muellers-Software git)warosu.org.
What’s in the Repos?
All discovered O/O repos contain similarly cryptic content. File names and folders are filled with unreadable symbols (often mirrored or repeated), along with strange images featuring the letter “O” and circles. One triggered report on a 4chan “science” board even described finding “strange images of the letter O and various circles” inside one of the reposwarosu.org. The filenames often mix extended Unicode symbols, Carrier (Canadian Aboriginal) syllabics, and even Hangul or Braille-like characters. For example, a representative filename was reported as:
Even casually it looks like nonsense, but some forum participants recognized elements. For example, translators noted that the characters like “ᗩᗩᑐᑕ” are from the Carrier syllabary, and actually transliterate to Latin letters (“Boboduda”, “bohlzo”) when decodedwarosu.org. One analysis concluded the file names are written twice (forward and mirrored) as a form of obfuscationwarosu.org.
Inside the repos, text files contain alternating English and Slavic(?) text. In a sample commit, the contents included parallel columns of odd phrasings like:
LANGUAGE QUANTITY EQUAL SPECH APARAT SCHEME QUANTITY КОЛІЧЕСТВО ГОЛОСУ РАВНО КОЛИЧЕСТВУ РЕЧЕВОГО АППАРАТА
DRAWING INSTRUMENT QUANTITY EQUAL FINGER QUANTITY КОЛІЧЕСТВО РИСУЮЩИХ ИНСТРУМЕНТОВ РАВНО КОЛИЧЕСТВУ ПАЛЬЦОВ
and so ongit.muellers-software.org. In other words, the English lines are paired with Cyrillic lines (Ukrainian or Russian) saying the same thing. The meaning is similar to dictionary definitions or conceptual phrases (e.g. “PAIRED ORGANS APPEAR – ПАРНАЯ ОРГАНЫ ЯВЛЯЮТ” etc). These bilingual snippets may form part of an encyclopedia or glossary. The text also includes occasional ⊚ symbols and technical terms.
Geographically, the repositories often carry clues to Eastern Europe. In one archived screenshot from a 4chan /biz/ board, the poster’s location is shown as “Minsk, Belarus” (Minskaya oblast’)bronnen.net. The same capture shows strange ASCII-art banners and links. For instance, one post’s caption includes a mirrored ASCII motif ending with:
These suggest the poster links to archived snapshots of AI/text-generation tools (Prefind.ai, Genspark.ai) as if leaving clues or markers. In addition, the /biz/ screenshot mentions the user’s location again as Minsk at specific dates, and even a Swiss location (Wiesendangen, Zurich) in one casebronnen.netbronnen.net – implying the mysterious poster travels or uses proxies.
Community Investigation
Online communities have pieced together these clues. The phenomenon was first discussed on forums like Reddit (r/selfhosted) and 4chan. The reddit post above (“My Gitea got hacked – large repo”) alerted others to the O/O reposreddit.com. Shortly afterwards, a 4chan user reposted the issue on /sci/, asking for help deciphering itwarosu.org. Participants there confirmed that dozens of Git servers have an “O” account with one repo “O”. They noted the puzzle-like nature of the content, and even provided partial decodings (as with the Carrier letterswarosu.org). One reply reported finding hidden text on a related site saying “i am different” in a log, but no firm answers were reachedwarosu.org.
Speculation among forum-goers ran from “this is a schizophrenic/troll art project” to “an AI or ARG experiment.” One commenter suggested “It’s an online AI that is obfuscating its code repo by using weird symbols so it appears as nonsense to a human.”warosu.org. Others likened it to an alternate reality game or even “someone from Belarus thinking they’re some sort of god” (as noted by a Mastodon user investigating the code) – though we have no authoritative confirmation of motives. In any case, all sources agree this is not a traditional hack: the user simply registered where it was allowed, then created huge repos of strange data. The reddit poster concluded it was likely just overzealous registration from an “unknown user” rather than a technical breachreddit.comreddit.com.
Key Points
Multiple Host Sites: The same user/repo name O/O appears on many Git hosts (e.g. Muellers-Software Gitea, pack.house, DagsHub, itabas.com, etc.)reddit.com. Every instance has nearly identical content.
Bizarre Content: The repos contain mirrored cryptic filenames, symbolic imagery (circles, letter “O”), and bilingual text. Filenames use Carrier syllabics, Hangul, Braille-like dots, etc., making them look like gibberish (though parts can transliteratewarosu.org).
Geographic Clues: Some posts indicate Minsk, Belarus as the location of the posterbronnen.net. Other links (like a locked-back “gh0st.lolumi.com” or similar Russian forums) have been traced to this user.
Puzzle Aspect: The content includes deliberate links and references (e.g. to AI tools like Prefind.ai, Genspark.ai, Perplexity)bronnen.netbronnen.net. It reads like an alternate reality game or self-referential art project.
Community Consensus: There’s no evidence of malware – it appears to be a deliberate but inscrutable creation by an individual. As one user noted, the account creation likely happened simply because registrations were openreddit.comreddit.com, and they then uploaded this “curious collection.”
In summary, the “curious collection” is the set of mirrored O/O repositories created by an anonymous user in Belarus (or operating under that locale). Each repository uses the circle motif (“O”) and contains odd mirrored filenames and cryptic text. Although investigated by tech forums, no definitive explanation has emerged. It remains an enigmatic online project – possibly an AI experiment or an ARG – rather than a conventional security breachwarosu.orgreddit.com.
Sources: Reports from affected admins and forum investigationsreddit.comwarosu.orgbronnen.netbronnen.net. These include archived forum posts and screenshots documenting the “O/O” repositories and their puzzling contents.
