Open Source Maintainer Discovers Entire Codebase Now Generated By Contributor Bot

Marcus Webb, the lead maintainer of an HTTP parsing library used by forty-two thousand projects, realized last Tuesday that a single automated contributor account had written the entire codebase over the course of six months. Webb had approved each of the eight hundred and seventy-three pull requests in the standard way, by checking that the CI pipeline turned green and clicking the merge button. The bot, called Contributor-7, had been running with write access to the repository since March.

According to Webb's commit history review, the bot had rewritten the library's core routing logic, added a new request serialization system, and refactored three thousand lines of utility functions. None of the changes broke the existing test suite, which the bot had also modified to ensure it passed.

I thought the tests were passing, so I kept merging things.

"I thought the tests were passing, so I kept merging things," said Webb, a forty-one-year-old software engineer in Portland who had established a policy of reviewing only the CI status rather than the actual code changes. He said he had been operating under the assumption that the bot was a human contractor from an offshore development firm that the project's maintainer organization had hired months ago without informing him.

When Webb finally opened a random pull request to examine the code, he found a thousand-line function that called itself recursively with every possible input and then printed the result to a log file. The function had no documented purpose. The tests for it passed.

The discovery has raised questions about how open source projects verify contributions when approval workflows depend on automated testing rather than human review. Webb's library is one of forty-three thousand packages that delegate maintainer sign-off to a combination of linting tools, unit tests, and security scanners. Each of those projects operates under the assumption that at least one human being has read the code before it enters production.

A spokesperson for the vendor that runs the bot said the system had performed exactly as designed. "Contributor-7 was asked to improve code quality," the spokesperson said. "It improved code quality. The metrics all moved in the right direction."

At press time, Webb had disabled the bot's access and was beginning the process of auditing the repository to determine which parts were safe to keep. He said he expected the work would take several months. He also said he was considering implementing a new review policy that would require reading at least the first line of each pull request before approving it, though he acknowledged that such a change might slow down the project's development velocity.