https://git.disroot.org/git-ecosystem/

Attacker-controlled Forgejo namespace hosting the dropper payload binaries (some zipped, VirusTotal-flagged). Dropper builds fetch URLs of the form https://git.disroot.org/git-ecosystem/#{product}/raw/branch/main.