GitHub Desktop
GitHub Desktop is a visual tool for tracking changes to project files and sharing them through GitHub or other Git services. It’s made by GitHub, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from github.com.
What it is
GitHub Desktop helps people work on software projects without typing Git commands. It shows changes to files, records versions and uploads or downloads changes.
It reads and changes files in the project folders you work with. It uses your GitHub account to access projects and share changes. Optional usage reporting sends information about how you use the app; this can be switched off in settings.
GitHub publishes it as a free, open source app for beginners and experienced developers. Its security advisories recommend keeping it updated and avoiding untrusted projects until relevant fixes are installed.
Who makes it
GitHub is a software collaboration company founded in 2008, based in San Francisco and owned by Microsoft since 2018. Its legal name is GitHub, Inc.. Its website is github.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of GitHub Desktop. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.github.GitHubClient. Download it only from github.com, not from an ad or a link someone sends you.
Fakes. In August 2025, attackers used Google ads and altered GitHub pages to promote fake GitHub Desktop downloads. Arctic Wolf found that the Mac download delivered AMOS malware, which steals information.
What it connects to
In normal use, GitHub Desktop talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
github.com | Sign-in and project transfers. |
api.github.com | Account and project information. |
central.github.com | Update checks and optional usage reporting. |
desktop.githubusercontent.com | App release downloads. |
cafe.github.com | Optional usage reporting in newer builds. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Automation | Integrates with external editors through Apple Events. |
Security record
Problems with GitHub Desktop or GitHub in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| An ignore-file flaw could let a malicious project change files outside its folder and lead to commands running; GitHub fixed it in Desktop 3.6.6. | ↗ | |
| A malicious editor extension led to theft of GitHub's internal repositories; GitHub contained the compromise and rotated secrets, with its May update reporting an ongoing investigation. | ↗ | |
| GitHub disclosed a flaw allowing commands to run on its servers through a crafted Git push; its hosted services were patched on 4 March and Enterprise Server fixes were released. | ↗ | |
| The bundled Git LFS component could write to arbitrary files through crafted links; GitHub fixed it in Desktop 3.5.4. | ↗ | |
| A crafted repository address could send stored sign-in credentials to the wrong server; GitHub fixed it in Desktop 3.4.12. | ↗ |
References
- GitHub Desktop application metadata raw.githubusercontent.com
- GitHub press information github.com
- Microsoft's acquisition of GitHub github.blog
- About GitHub Desktop docs.github.com
- GitHub Desktop official download page github.com
- Updating GitHub Desktop docs.github.com
- GitHub Desktop release notes desktop.github.com
- GitHub Desktop downloads and project information github.com
- GitHub Desktop API connections raw.githubusercontent.com
- GitHub Desktop update endpoint raw.githubusercontent.com
- GitHub Desktop usage reporting endpoints raw.githubusercontent.com
- GitHub Desktop usage reporting github.com
- GitHub Desktop macOS permission description raw.githubusercontent.com
- GPUGate: malicious GitHub Desktop downloads arcticwolf.com
- GitHub Desktop ignore-file security advisory github.com
- Investigation into theft of GitHub's internal repositories github.blog
- GitHub Git push security flaw and fixes github.blog
- Git LFS arbitrary-file-write security advisory github.com
- GitHub Desktop credential-leak security advisory github.com