Weaponizing the Commons: A Taxonomy and Detection Framework of Abuse on GitHub

• URL: http://arxiv.org/abs/2604.17909v1
• Date: Mon, 20 Apr 2026 07:37:03 GMT
• Title: Weaponizing the Commons: A Taxonomy and Detection Framework of Abuse on GitHub
• Abstract summary: GitHub plays a critical role in modern software supply chains, making its security an important research concern.<n>Existing studies have primarily focused on CI/CD automation, collaboration patterns, and community management, while abuse behaviors on GitHub have received little systematic investigation.<n>In this paper, we systematically review and summarize reported GitHub abuse behaviors and conduct an empirical analysis of publicly available abuse cases.<n>Based on this investigation, we propose a comprehensive taxonomy that characterizes their diverse symptoms and root causes from a software security perspective.
• Score: 31.618034402766018
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: GitHub plays a critical role in modern software supply chains, making its security an important research concern. Existing studies have primarily focused on CI/CD automation, collaboration patterns, and community management, while abuse behaviors on GitHub have received little systematic investigation. In this paper, we systematically review and summarize reported GitHub abuse behaviors and conduct an empirical analysis of publicly available abuse cases, curating a manually labeled dataset of 392 GitHub instances. Based on this investigation, we propose a comprehensive taxonomy that characterizes their diverse symptoms and root causes from a software security perspective. Building on this taxonomy, we develop a unified detection framework capable of identifying all abuse categories across repositories and user accounts. Evaluated on the constructed dataset, the proposed framework achieves high performance across all categories (e.g., F1-score exceeding 89%). Collectively, this work advances the understanding of GitHub abuse behaviors and lays the groundwork for large-scale, systematic analysis of the GitHub platform to strengthen software supply chain security.

Related papers

• Beyond Compliance: A Large Scale Study on the Completeness and Consistency of the GitHub SBOMs [1.068768727414769]
  We conduct a large-scale analysis of 10,000 GitHub repositories across ten programming language ecosystems.<n>We find a lack of NTIA compliance in GitHub SBOMs, though core metadata is consistently present.<n>We also find that component version and license information availability is highly dependent on the programming ecosystem.
  arXiv  Detail & Related papers  (2026-07-06T02:44:52Z)
• Deciphering WONTFIX: A Mixed-Method Study on Why GitHub Issues Get Rejected [0.0]
  The study examines the prevalence and reasons behind issues being labeled as wontfix across various open-source repositories on GitHub.<n>Our findings show that about 30% of projects on GitHub apply the wontfix label to some issues.<n>The study identified eight common themes behind labeling issues as wontfix, ranging from user-specific control factors to maintainer-specific decisions.
  arXiv  Detail & Related papers  (2025-10-01T23:22:18Z)
• SwingArena: Competitive Programming Arena for Long-context GitHub Issue Solving [90.32201622392137]
  We present SwingArena, a competitive evaluation framework for Large Language Models (LLMs)<n>Unlike traditional static benchmarks, SwingArena models the collaborative process of software by pairing LLMs as iterations, who generate patches, and reviewers, who create test cases and verify the patches through continuous integration (CI) pipelines.
  arXiv  Detail & Related papers  (2025-05-29T18:28:02Z)
• Automating the Detection of Code Vulnerabilities by Analyzing GitHub Issues [6.6681265451722895]
  We introduce a new dataset specifically designed for classifying GitHub issues relevant to vulnerability detection.<n>Results demonstrate the potential of this approach for real-world application in early vulnerability detection.<n>This work has the potential to enhance the security of open-source software ecosystems.
  arXiv  Detail & Related papers  (2025-01-09T14:13:39Z)
• Visual Analysis of GitHub Issues to Gain Insights [2.9051263101214566]
  This paper presents a prototype web application that generates visualizations to offer insights into issue timelines. It focuses on the lifecycle of issues and depicts vital information to enhance users' understanding of development patterns.
  arXiv  Detail & Related papers  (2024-07-30T15:17:57Z)
• Alibaba LingmaAgent: Improving Automated Issue Resolution via Comprehensive Repository Exploration [64.19431011897515]
  This paper presents Alibaba LingmaAgent, a novel Automated Software Engineering method designed to comprehensively understand and utilize whole software repositories for issue resolution.<n>Our approach introduces a top-down method to condense critical repository information into a knowledge graph, reducing complexity, and employs a Monte Carlo tree search based strategy.<n>In production deployment and evaluation at Alibaba Cloud, LingmaAgent automatically resolved 16.9% of in-house issues faced by development engineers, and solved 43.3% of problems after manual intervention.
  arXiv  Detail & Related papers  (2024-06-03T15:20:06Z)
• MAGIS: LLM-Based Multi-Agent Framework for GitHub Issue Resolution [47.850418420195304]
  Large Language Models (LLMs) have shown promise in code generation but face difficulties in resolving GitHub issues. We propose a novel Multi-Agent framework for GitHub Issue reSolution, MAGIS, consisting of four agents customized for software evolution.
  arXiv  Detail & Related papers  (2024-03-26T17:57:57Z)
• Unveiling A Hidden Risk: Exposing Educational but Malicious Repositories in GitHub [0.0]
  We use ChatGPT to understand and annotate the content published in software repositories. We carry out a systematic study on a collection of 35.2K GitHub repositories claimed to be created for educational purposes only.
  arXiv  Detail & Related papers  (2024-03-07T11:36:09Z)
• Exploring Security Practices in Infrastructure as Code: An Empirical Study [54.669404064111795]
  Cloud computing has become popular thanks to the widespread use of Infrastructure as Code (IaC) tools. scripting process does not automatically prevent practitioners from introducing misconfigurations, vulnerabilities, or privacy risks. Ensuring security relies on practitioners understanding and the adoption of explicit policies, guidelines, or best practices.
  arXiv  Detail & Related papers  (2023-08-07T23:43:32Z)
• On the Security Blind Spots of Software Composition Analysis [46.1389163921338]
  We present a novel approach to detect vulnerable clones in the Maven repository. We retrieve over 53k potential vulnerable clones from Maven Central. We detect 727 confirmed vulnerable clones and synthesize a testable proof-of-vulnerability project for each of those.
  arXiv  Detail & Related papers  (2023-06-08T20:14:46Z)
• Predicting Issue Types on GitHub [8.791809365994682]
  Ticket Tagger is a GitHub app analyzing the issue title and description through machine learning techniques. We empirically evaluated the tool's prediction performance on about 30,000 GitHub issues.
  arXiv  Detail & Related papers  (2021-07-21T08:14:48Z)
• S3M: Siamese Stack (Trace) Similarity Measure [55.58269472099399]
  We present S3M -- the first approach to computing stack trace similarity based on deep learning. It is based on a biLSTM encoder and a fully-connected classifier to compute similarity. Our experiments demonstrate the superiority of our approach over the state-of-the-art on both open-sourced data and a private JetBrains dataset.
  arXiv  Detail & Related papers  (2021-03-18T21:10:41Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.