  Exploit proof-of-concepts (PoCs) for known vulnerabilities are widely shared
in the security community. They help security analysts to learn from each other
and they facilitate security assessments and red teaming tasks. In the recent
years, PoCs have been widely distributed, e.g., via dedicated websites and
platforms, and public code repositories such as GitHub. However, there is no
guarantee that PoCs in public code repositories come from trustworthy sources
or even that they do what they are supposed to do.
  In this work we investigate GitHub-hosted PoCs for known vulnerabilities
discovered in 2017--2021. We discovered that not all PoCs are trustworthy. Some
proof-of-concepts are malicious, e.g., they attempt to exfiltrate data from the
system they are being run on, or they try to install malware on this system,
and in some cases they have hard-coded reverse shell listener.
  To measure the prevalence of this threat, we propose an approach to detecting
malicious PoCs. Our approach relies on the maliciousness symptoms we have
observed in our PoC dataset: calls to malicious IP addresses, encoded malicious
code, and included Trojanized binaries. With this approach, we have discovered
899 malicious repositories out of 47,285 repositories that have been downloaded
and checked (i.e., 1.9% of the studied repositories have indicators of
malicious intent). This figure shows a worrying prevalence of dangerous
malicious PoCs among the exploit code distributed on GitHub.
