Bot accounts are cloning trending repos with fake backdated commit histories (7 accounts against one repo this week)

[ACoci86]

🏷️ Discussion Type

Question

Body

Hi, I maintain a small open source project, terrahour. Since Monday, seven new accounts have each created a repository with the same name. Each one copies my README, description, topics and screenshots. They aren't forks and share no git history with my repo.

They all come from the same template:

• Four identical Python files, each containing only this, plus filler comment lines like # guard against empty input:

  """A world clock for the terminal, with a day and night map and"""

  def main() -> None:
      print("ok")

• 70 to 220 commits backdated to early 2025, with generated messages that don't match the changes. My project's first commit is 1 October 2026.
• A self-merged PR, and sometimes empty releases.
• Most of them got new commits today, so the generator is still running.

Example: https://github.com/kerstin89/terrahour

I've reported two of them through the report form. Nothing has been removed yet.

I'm posting here for two reasons:

1. Could someone from staff look at these as a group? The truncated docstring plus print("ok") is a fingerprint that should find all seven, and probably other accounts made by the same tool on other repos too.
2. Has any other maintainer seen this happen to their project?

Many thanks for your time!

[yashh1323]

@ACoci86, I can’t say whether staff will treat these as a group, but two things might get them moving faster.

Your README, description and screenshots are your original work, so each copy can go through GitHub’s DMCA takedown form. As far as I know that is a separate process from the abuse report queue, and your first commit on 1 October 2026 shows which came first.

For the abuse reports, I’d put all seven URLs in a single report and quote the truncated docstring plus print("ok") in the text. That way whoever opens it sees one pattern, not seven unrelated reports.

[abdikadirjerry]

I’d recommend documenting the incidents in a structured way before reporting them. Keep a list of the original repository, each suspected clone, the relevant commit hashes, and links to any matching files or unusual commit patterns.

It’s also worth distinguishing suspicious activity from confirmed abuse. Backdated commits alone don’t necessarily prove malicious intent, so reports should focus on verifiable evidence rather than assumptions about the accounts involved.

If several repositories are affected, consolidate the evidence and submit it through GitHub’s official reporting channels. This gives GitHub a clearer picture of the pattern and makes the report easier to investigate. If the copied material is your original copyrighted work, review GitHub’s copyright reporting process as a separate option.

Have you already collected the repository URLs and commit hashes for all seven accounts? That would be a useful starting point for identifying the common pattern.

[ACoci86]

Thanks, I've already done that. I have a list of the original repo, every copy, the matching files and the commit patterns. It's 13 accounts now, not seven. I've sent everything to GitHub as one consolidated report through their official form, with all the URLs in it.

There's one more thing I noticed: the profile pictures on these accounts are stolen from other real GitHub users. So it isn't only my project being copied. Other people's identities are being used to make the accounts look real.

Honestly, I don't know if this is normal. Have you seen this kind of thing before? And do you know why GitHub doesn't act on it faster? All the accounts follow the same obvious pattern, so I'm surprised they're still up.

[imraantalib17]

@ACoci86 can you send me a list of the accounts? I want to check it out