Nintendo sent GitHub four DMCA notices this week, all dated November 6, 2026. By Kotaku's count, about 217 Switch-related repositories are now disabled.

I've been writing PHP for more than 13 years, and I have no stake in Switch modding. What caught my eye was how many of those 217 repos were forks. That part matters to anyone who builds software on top of someone else's code, which these days is all of us.

What actually happened

TorrentFreak reported first on the biggest notice. It targets Picofly, open-source firmware for a Switch modchip built on a cheap RP2040-Zero board. Nintendo argues that the console's boot sequence and cryptographic signatures are "technological protection measures", and that the firmware lets modchips "illegally circumvent" them. As far as TorrentFreak can tell, none of Nintendo's 90 earlier notices in GitHub's archive mention modchips, so this looks like a first.

GitHub disabled the whole Picofly network, 144 repositories including forks.

The other three notices hit emulators built on Yuzu, the Switch emulator whose developers agreed in 2024 to pay Nintendo $2.4 million. The Citron Neo notice alone disabled 71 repositories. Two more notices targeted single Yuzu repos. Their owner wiped the code and left a README pointing to the Internet Archive.

Nintendo hasn't commented beyond the notices. Reports also say some Picofly and HWFLY repos are still online, so this isn't a clean sweep.

The fair version of both sides

I'll be honest: I don't think this is a simple good-guys/bad-guys story.

Nintendo makes the console and the games, and it has a legal right to protect them. Modchips are mainly used to run pirated games, and piracy lands on the developers who spent years making them. I've shipped products and watched people use them in ways I never intended. I get the instinct.

The other side has a point too. Firmware isn't a game. The case Nintendo leans on, against Team Xecuter's Gary Bowser, ended in a guilty plea, not a court ruling on modchip firmware. And people do legitimately tinker with hardware they paid for.

I'm not going to settle that in a blog post. My lesson is smaller.

A fork is a photocopy the library can take back

Many people, including developers with years of experience, treat a GitHub fork as "my copy". It shows up under your name and in your list of repos. It feels like yours.

It isn't really. It lives on the same platform, under the same rules, inside the same "fork network". When a notice says the forks infringe too, GitHub can disable the whole family in one go. That's what happened to 144 repos here, and to 71 more in the Citron Neo case.

The everyday version: you photocopy a chapter at the library, and the library keeps the photocopy. When the book is pulled, your copy leaves with it.

This isn't really about Nintendo. Repos go private, maintainers rage-quit, accounts get suspended, companies get acquired and archive things. Most of my scars from depending on outside code came from boring stuff like that, not from lawyers.

The cheap fix

For anything your product actually depends on, keep a copy somewhere you control. It takes about ten minutes:

# one-time git clone --mirror https://github.com/some/dependency.git # on a schedule (cron, CI job, whatever you already have) cd dependency.git && git remote update --prune

A few more habits I'd recommend:

  • Know your critical list. Not every dependency matters. Write down the 5 to 10 you'd be stuck without.
  • Mirror outside GitHub. A second remote on GitLab, Codeberg, a self-hosted Gitea, or just a NAS. Same platform means same risk.
  • Keep build artifacts too. For PHP that means a private Packagist/Satis or a vendor cache, so a missing upstream doesn't break composer install on a Friday.
  • Check your licenses. Mirroring open-source code you're allowed to use is normal. Mirroring something that was taken down for a legal reason is a different question, and you should think about it before you do it.

None of this is exciting, and it's still the kind of thing you're glad you did the one time it matters.

Your turn

Do you keep your own mirror of the code your product depends on, or do you trust GitHub and the package registries to always be there? Why?