Ask HN: What are GitHub's push-farm botnets for?
Summary not yet generated for this article.
Original Text
Every hour GH Archive records ~160K public GitHub events, and right now ~64% of the pushes are spam. Thousands of auto-created accounts (word+digits usernames like smithhoward5868, gibberish repo names) push hundreds of times an hour to fresh repos, 24/7. One repo, LiamBruhin/SillyStuff, pushed 690 times in a single hour from ONE actor, and has kept that up for 13+ hours straight.
I built a live radar that had to detect these farms to rank honestly, and I've been tracking them for 34 hours. Live: https://github-pulse.surge.sh — full writeup with charts and the farm ledger: https://github-pulse.surge.sh/report.html — open-source single script: https://github.com/Atheistam/github-pulse
But I genuinely don't know what they're FOR. No stars, no forks, no issues, no PRs, no meaningful README — just endless pushes to fresh gibberish repos. SEO? GitHub Actions reselling? Training-data poisoning? Has anyone seen this pattern before, or does anyone know what the endgame is?
Comments (1 of ) ⌛