Slay the Spire 2 Code and 228 Poki Games Hit by GitHub Takedowns

Game companies asked GitHub to take down a long list of leaked and copied game code in the first half of October. Poki went after 228 copies of its browser games. Mega Crit went after a repository it says held the private source code of Slay the Spire 2. And the seller of a paid Roblox script said a cracked copy had been posted.

These requests are called DMCA takedown notices, and GitHub publishes a copy of each one. Between October 1 and 15, 2026, it posted 158 files. At least two dozen involve games, game mods or tools built around games. These are the ones that stand out.

Poki: 228 copied browser games

Poki runs a free browser games website. Its notice, posted October 14, lists 228 repositories that copied the code and art of games it licenses, including Monkey Mart, Stickman Hook, Drive Mad and Crossy Road.

The notice also explains why this keeps happening. Poki’s games are meant to run only on approved websites, but the code runs in the player’s browser, so it is easy to copy. Its efforts to scramble or lock the code, Poki wrote, “have thus far only hurt legitimate players, whilst for game-rippers it remained trivial to circumvent.”

Mega Crit: Slay the Spire 2’s source code

Mega Crit’s notice, posted October 6, targets one repository. The studio says it held the game’s “proprietary source code, which has never been published or licensed for public distribution,” along with its art, audio and card text. Asked for the uploader’s contact details, Mega Crit wrote: “There’s no contact information or even a README.”

Nintendo: Switch emulators

Nintendo sent two notices, posted October 1, against repositories offering Switch emulators: a copy of Ryujinx, one built on Yuzu, and copies of both. Nintendo says emulators use copied “prod.keys,” the keys that unlock Switch games, and that this breaks U.S. anti-circumvention law. Both notices point to the March 2024 judgment against Tropic Haze, the maker of Yuzu, and a ruling in Colorado in November 2025.

A paid Roblox script, leaked

Another notice, posted October 14, came from the seller of CARNAGE, a paid “Roblox script suite.” Buyers normally get it from the seller’s own server, locked with a license key. According to the notice, the copy on GitHub had a header saying it was “DEOBFUSCATED AND LEAKED,” with the “Key System, IP Logs, blocklist and other pings” removed, so it ran without a license.

Other game notices

• RimWorld (October 12): one notice covers 24 repositories that, it says, turned the game’s files back into readable code and posted it.
• Minecraft (October 1–14): ten notices. The detailed ones say the repositories get around the game’s “authentication, entitlement, or access-control mechanisms.” The sender’s name is blacked out.
• Happy Wheels (October 2): the notice says a repository copied the Steam version’s files “verbatim.”
• Arknights: Endfield (October 1): the target is a tool that decrypts the game’s data files.

Two developers pushed back

Two developers filed counter-notices, telling GitHub their takedowns were a mistake. One maintains GreenLuma Manager, a tool for the GreenLuma Steam unlocker. Their dispute is with another developer, not a game company, over licensing: they say the original code is MIT-licensed, their additions are GPLv3, and the only thing they removed was a copyright line in the app. The author of a tool that updates Nvidia’s DLSS files in games also disputed a takedown.

Under the DMCA, GitHub can restore the code 10 to 14 business days after a valid counter-notice, unless the sender of the original notice sues. Every notice here is a claim, not a court ruling, and GitHub does not decide who is right.

Related: the game industry’s push to get cheat sellers listed as piracy markets.