GitHub’s Anti-Spam System Is Struggling Against Persistent Abuse #191078
Replies: 8 comments 11 replies
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
|
See my reply here: microsoft/WSL#40028 (comment) |
Beta Was this translation helpful? Give feedback.
-
|
It is increasing very quickly 
|
Beta Was this translation helpful? Give feedback.
-
|
974k 
|
Beta Was this translation helpful? Give feedback.
-
|
OMG It's still going |
Beta Was this translation helpful? Give feedback.
-
|
Yes it is still going, but the total count won't exceed 100k anymore GitHub is definitely taking actions to banning and removing them, but GitHub is not able to stop them. |
Beta Was this translation helpful? Give feedback.
-
|
Are you sure |
Beta Was this translation helpful? Give feedback.
-
Why don't open the search page I provided? 
|
Beta Was this translation helpful? Give feedback.
-
|
Github have a idea to go out this spam issus,but you not to change it |
Beta Was this translation helpful? Give feedback.
-
|
nearing 500 repos that contains 80k issues reported, that is crazy. https://github.com/xlionjuan/gh-spam/blob/main/github-spam-report-2026-04-01.md |
Beta Was this translation helpful? Give feedback.
-
|
Hey @xlionjuan
|
Beta Was this translation helpful? Give feedback.
-
I can only analyze the content or title of the spam issues, I'm not the site operator, I'm not able to analyze the detail informations for the spam accounts(IP, time patterns, API request fingerprint or register mails etc), the GitHub side should definitely taking action about this.
If you or you know someone can helping this it would be great.
It is already happening, no matter it is SEO/model poisoning GitHub has the records for being a platform to spreading malware and spam emails, but they're not able to deal this properly. |
Beta Was this translation helpful? Give feedback.
-
|
It sounds like you're diving into a high-stakes discussion about platform integrity and the AI supply chain. The core issue here is that GitHub’s "tolerance threshold" for spam isn't just a nuisance; it’s actively polluting the datasets used to train models like Codex, leading to a massive accountability gap. Since you're) is limited to analyzing public content (titles/issues) and confirmed that SEO/model poisoning is already happening, the ball is in the community's court to escalate. 1. The "Open Letter" / Public ExposureSince the your're looking for help with visibility, the most effective next step is a data-backed post for sites like Hacker News (YC), Lobsters, or the r/MachineLearning subreddit.
2. Forensic Pattern Analysis (Public Data)Even without internal logs (IPs/Emails), we can analyze the public fingerprints:
3. Highlighting the Security RiskYou confirmed this is already being used for SEO poisoning. To get Microsoft’s security teams to move faster, you should document if these spam links lead to:
PS: Pls upvote if this helps |
Beta Was this translation helpful? Give feedback.
-
|
looks like it is stopped |
Beta Was this translation helpful? Give feedback.
-
|
It shows that around 90k Chinese spam issues are existing now, using xlionjuan's search term. Crawlers highly valuate Github, especially as there are fewer and fewer crawlable websites. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, it is around 100k for few days GitHub is deleting them very quickly without doubt But GitHub still not able to stop them, which is really really funny 🤣 |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
🏷️ Discussion Type
Product Feedback
💬 Feature/Topic Area
Other
Body
Summary
In recent days, GitHub has once again been flooded with large-scale Chinese spam. This is not a new problem, nor a rare occurrence—it is a recurring pattern that has been visible for years without any clearly effective resolution. Microsoft’s WSL repository is simply one of the latest high-profile examples.
The following discussions document the issue in detail and highlight the scale and persistence of the problem:
microsoft/WSL#40028
microsoft/WSL#21802
Request
GitHub and Microsoft need to acknowledge the seriousness of this issue—not in abstract terms, but in terms of concrete impact and accountability.
The ongoing presence of large-scale spam repositories calls into question whether current moderation and abuse-prevention mechanisms are functioning at an acceptable level. When such content remains widespread and long-lived, it is difficult to interpret this as anything other than a systemic failure to contain known abuse patterns.
More critically, GitHub is not just a hosting platform—it is widely used as a data source for training AI systems. Allowing large volumes of low-quality or malicious content to persist creates a foreseeable risk: contamination of training datasets. This concern is not hypothetical; it directly relates to cases already raised regarding OpenAI’s Codex.
openai/codex#11966
Framed this way, the issue extends beyond spam itself. It raises a broader question: to what extent are GitHub and Microsoft willing to take responsibility for the downstream consequences of the data they host and distribute at scale?
Using AI-assisted analysis, I have identified a significant number of spam repositories, with some cases traceable back to as early as 2023. The longevity of these repositories strongly suggests that this is not merely a detection problem, but a prioritization problem.
I've submitted the following reports to GitHub.
https://github.com/xlionjuan/gh-spam/blob/main/github-spam-report-2026-03-30.md
https://github.com/xlionjuan/gh-spam/blob/main/github-spam-report-2026-03-30-historical.md
At this point, continued inaction—or responses that fail to materially reduce the scale of the problem—will increasingly be seen not as oversight, but as tacit acceptance.
Beta Was this translation helpful? Give feedback.
All reactions