State of GitHub Spam — a 109-hour investigation by GitHub Pulse

🧟">

🧟 Investigation · 2026-08-11-0 → 2026-08-15-12 · auto-generated hourly

The State of GitHub Spam

GitHub publishes every public event — push, PR, issue, star — into the GH Archive, hour by hour. We process the whole stream and found something strange: a large fraction of the pushes are not people. They are automated push-farms — fleets of auto-created accounts pushing to freshly-created gibberish repositories, hundreds of times per hour, forever. This is what 109 hours of looking at them looks like.

109<br>hours observed

17,687,127<br>events processed

46.7%<br>avg share of pushes that are spam

61.0%<br>right now (08-15-12)

46<br>farms tracked

324,746<br>repos demoted from rankings

01 Half of GitHub's pushes are not human

Each bar is one hour. The line is the share of that hour's pushes judged to be farm spam — accounts with no human signal (no PRs, issues, stars, forks, or releases), pushing to fresh auto-generated repos. It swings between 22.5% and 71.4% — never below a third, sometimes above six-tenths. The farms ebb and flow; they never leave.

56%36%15%<br>08-11-008-11-808-11-1608-12-008-12-808-12-1608-13-008-13-808-13-1608-14-008-14-808-14-1608-15-008-15-8

How much farm traffic was caught per hour: repos demoted out of the rankings for farm behaviour (red) plus suspicious push-loops (grey). The last hours are the most aggressive the farms have been since we started watching.

2321154877408-11-0: 2,65608-11-1: 3,09508-11-2: 2,02908-11-3: 1,69508-11-4: 1,54608-11-5: 1,57508-11-6: 1,37808-11-7: 1,33308-11-8: 1,67408-11-9: 1,74008-11-10: 1,76208-11-11: 2,01108-11-12: 1,37308-11-13: 2,41708-11-14: 2,37208-11-15: 2,09808-11-16: 1,04008-11-17: 95308-11-18: 1,16108-11-19: 1,10108-11-20: 1,16608-11-21: 1,13208-11-22: 1,13108-11-23: 1,09508-12-0: 88408-12-1: 81108-12-2: 94708-12-3: 98308-12-4: 1,45008-12-5: 1,95508-12-6: 2,50308-12-7: 2,42008-12-8: 2,79308-12-9: 2,78108-12-10: 1,89608-12-11: 1,57308-12-12: 1,29408-12-13: 1,25808-12-14: 1,69008-12-15: 1,57408-12-16: 1,33508-12-17: 87008-12-18: 86108-12-19: 89608-12-20: 83208-12-21: 79708-12-22: 83208-12-23: 72208-13-0: 63808-13-1: 59308-13-2: 63408-13-3: 67208-13-4: 83308-13-5: 1,05908-13-6: 2,78008-13-7: 2,52808-13-8: 2,04108-13-9: 2,47208-13-10: 2,33208-13-11: 2,05608-13-12: 2,38008-13-13: 1,77008-13-14: 1,35008-13-15: 1,97908-13-16: 1,65608-13-17: 1,12508-13-18: 1,42608-13-19: 1,24308-13-20: 1,20108-13-21: 1,16008-13-22: 1,24808-13-23: 1,17008-14-0: 1,15308-14-1: 1,03408-14-2: 1,13008-14-3: 1,16208-14-4: 94708-14-5: 1,19908-14-6: 1,69508-14-7: 1,52408-14-8: 1,76608-14-9: 1,59708-14-10: 1,64608-14-11: 1,63008-14-12: 1,06408-14-13: 99008-14-14: 2,16408-14-15: 2,25108-14-16: 1,40708-14-17: 1,52408-14-18: 1,98308-14-19: 1,95608-14-20: 2,03308-14-21: 2,01508-14-22: 1,90208-14-23: 1,87008-15-0: 2,62408-15-1: 2,46008-15-2: 2,45108-15-3: 1,77608-15-4: 1,50108-15-5: 1,64708-15-6: 2,14608-15-7: 1,50808-15-8: 2,37908-15-9: 2,65708-15-10: 2,47508-15-11: 2,56908-15-12: 2,81508-11-008-11-808-11-1608-12-008-12-808-12-1608-13-008-13-808-13-1608-14-008-14-808-14-1608-15-008-15-8

02 The farms<br>persistent actors, tracked across hours — repos rotate, accounts persist

These are the longest-running operations. hours seen counts distinct hours the farm appeared; peak is its most pushes in a single hour. LiamBruhin/SillyStuff — one account, one repo, up to 690 pushes in an hour — has outlasted every countermeasure so far.

farm / repohours seenpeak pushes/hrfirst → last seen<br>LiamBruhin/SillyStuff138482026-08-11-12 → 2026-08-14-7ugmoddev/API-NEW-NAT-3-135962026-08-11-12 → 2026-08-15-9zerotraceh1/er-forge-probe135552026-08-11-12 → 2026-08-15-9elad-cmd/psycho-usage134032026-08-11-12 → 2026-08-15-9Fadil123-hah/DILZXJASHER113912026-08-11-23 → 2026-08-15-3ugmoddev/noti-api-server113572026-08-11-11 → 2026-08-15-9aaaaqaap/-abu_turab793032026-08-12-0 → 2026-08-12-4jvhoang/p6v2-public-stats74002026-08-11-15 → 2026-08-14-17CodeHub-Clients/CodeHub_Licenses72822026-08-11-21 → 2026-08-14-3goodluckk22/images63102026-08-11-22 → 2026-08-12-0itaalo67/epg_picons56752026-08-13-12 → 2026-08-13-19loan96060-tech/vbpl-storage-tu-154912026-08-11-12 → 2026-08-13-9loan96060-tech/vbpl-storage-dp-153972026-08-11-11 → 2026-08-13-7betorj04/data3453302026-08-11-15 → 2026-08-11-18AmericanMedicalCompliance/amc-tracker53012026-08-12-20 → 2026-08-13-21pytho584/mdn-persian52522026-08-12-11 → 2026-08-12-20wsch40/rsrhio51332026-08-14-14 → 2026-08-14-23Janfindl/AFL_Live51052026-08-15-6 → 2026-08-15-8xolirx/list-check45122026-08-11-18 → 2026-08-12-18betorj04/Toggle_Server10243182026-08-11-15 → 2026-08-11-17

03 The 3-hour cadence & the account factory<br>v5.18 — RULE REBORN: h6's 1,497 mint → h7 dip (32.2%) → h8 breach (+23.8pt, 56.0%) → h9 64.4% (5th-highest hour ever)

Between Aug 13 06:00 and 15:00 UTC the spam share stopped drifting and started pulsing : 66.2% → 62.8% → 53.0% → 60.2% — a surge every ~3 hours with 23–40% lulls between. The engine was visible in...