Skip to content

Security: scholzri/rainy75-zmk

Security

SECURITY.md

Security Policy

Official distribution

The only official home of this project is github.com/scholzri/rainy75-zmk.

This project distributes firmware source code only. There is no official binary download, .exe, .zip, or one-click installer. Installation is from source via the documented methods in docs/zmk-firmware.md (OTA bridge → mcumgr DFU, or SWS with a hardware debugger).

Impersonation / fake "firmware download" sites

Scam accounts copy this repository and publish GitHub Pages sites with a fake "Download Latest Release" button that serves malware (typically a Windows Lua-loader: Application.batluau.exe + an obfuscated Lua payload).

How to recognize a fake:

  • It offers a .zip/.exe download — this project has none.
  • It describes a "hold Escape, drag a .uf2 onto the RAINY75 USB drive" flow — the Wobkey Rainy 75 has no UF2 / mass-storage bootloader; that procedure is physically impossible on this hardware.
  • It is not hosted under github.com/scholzri.

Known instances

Date Site Payload SHA-256 Status
2026-07 hxxps://adventsundaysliminess908[.]github[.]io (copied repo, no attribution) 5d93a476398c736984b0e4de4091f65d0cba13f2d9153b04b2eaf16565df734c Reported to GitHub (abuse/DSA), VirusTotal (URL flagged malicious), Google Safe Browsing, Microsoft SmartScreen

URLs above are defanged on purpose — do not visit them.

Reporting

Found another impersonator, or a vulnerability in the firmware itself? Please open an issue in this repository.

There aren't any published security advisories