A Reddit user named NotCSM said in the r/webdev forum on 7 November 2026 that SVGRepo showed a fake Cloudflare check page. SVGRepo is a site that offers free SVG images. The poster said the page tried to put malware on their computer, and that they nearly fell for it. Commenters called it a ClickFix attack. In that trick, a fake check asks you to paste a command into the Windows Run box.
The claim rests on one user's post and its screenshots. Nothing in the thread shows SVGRepo has replied or confirmed it was hacked. How many visitors saw the page, how long it ran, and what the malware does are all unknown. One commenter guessed that bad ads were behind it, but offered no proof. Commenters said SVG files can carry scripts, yet no one reported a tampered file.
Teams that pull icons and images from free libraries may want to treat recent downloads with care until the site says it is clean. A commenter noted that a real Cloudflare check never asks you to paste a command. That commenter also said anyone who did should assume the machine is compromised and change passwords from another device.