---
title: "40 Million Fake Commits Flood GitHub’s Public Feed"
url: https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1
source_url: https://blog.gitguardian.com/40-million-fake-push-when-spam-commits-took-over-the-public-github
type: article
source: "GitGuardian"
published: 2026-08-05T14:46:25.977Z
updated: 2026-08-05T14:46:51.106Z
tags: ["security", "github", "gitguardian"]
reading_time: 7
upvotes: 8
comments: 1
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 40 Million Fake Commits Flood GitHub’s Public Feed

**[GitGuardian](https://daily.dev/sources/gitguardian)** · 7 min read · 8 upvotes · 1 comments

## Summary

Since mid-July 2026, GitHub's public event feed has been overwhelmed by a massive spam campaign generating up to 40 million fake commits per day — roughly 5x the June baseline and over 70% of all observable public events. GitGuardian's monitoring detected the anomaly by tracking a sudden spike above the normal 8M daily commit rate. Investigation revealed the commits share common traits: random 6-letter repo names, unrelated email addresses, and files containing Chinese characters, domain names, and AI-generated images. Tracing the redirect chain through dozens of .cc and .vip domains hosted in Hong Kong ultimately leads to an illegal Chinese online gambling site impersonating a defunct lottery brand. The campaign appears aimed at promoting the gambling platform and ensuring its resilience against takedowns via a large pool of rotating domains. A side effect is that GitHub's public metrics — commit counts, repo counts, active users — are now significantly inflated by non-development activity, illustrating how easy bot-driven automation has become even on mature platforms.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://blog.gitguardian.com/40-million-fake-push-when-spam-commits-took-over-the-public-github>

## Community discussion

Top comments from developers on daily.dev.

**@h3l0st3k** · 0 upvotes

> This is a fascinating OSINT case. Following infrastructure, domain rotation, and behavioral patterns across millions of events demonstrates how public development platforms can also become valuable sources for tracking coordinated abuse campaigns.

## Similar posts on daily.dev

- [News alert: GitGuardian study shows AI coding tools double leak rates as 29M credentials hit GitHub](https://daily.dev/posts/news-alert-gitguardian-study-shows-ai-coding-tools-double-leak-rates-as-29m-credentials-hit-github-hkqb5n1dy) · Security Boulevard · 2 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#gitguardian](https://daily.dev/tags/gitguardian)

[View this post on daily.dev](https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1)