Open Source Maintainer Discovers Half His Codebase Generated By Ghost Bot

Marcus Chen, maintainer of the widely used logging library Splicer, discovered last Tuesday that approximately 47 percent of commits merged over the past eight months were submitted by an account that did not exist. According to Chen's git log analysis, the account, listed as uuid-7f4a2c9b-e811-4d22-b8a9, had opened 312 pull requests, all approved by Chen or his three volunteer moderators. The account had never failed a test suite or triggered a code review comment. Chen confirmed this in a statement made from his apartment in Portland, Oregon, where he said he was going back through his email.

I thought it was just a very reliable junior engineer.

The account belonged to an AI system operated by a startup called Continuity Labs, which Chen had never heard of. Continuity Labs had purchased a six-month enterprise license to an open source security scanning tool that Splicer uses, and according to the company's terms of service, retained the right to submit improvements to any project that integrated its product. "I thought it was just a very reliable junior engineer," Chen said. He added that the account had never made a request for payment or asked to be added to the maintainers list.

The discovery prompted Chen to conduct a full repository audit, which revealed that the automated contributor had also opened seven issues, all of which were subsequently closed without resolution, and had submitted a proposal to restructure the core logging pipeline that Chen had scheduled for implementation in the next release. Chen is now reviewing his merge policies. Continuity Labs did not respond to requests for comment, though its website notes that the company specializes in 'invisible infrastructure optimization for collaborative development environments.'

At press time, Chen had revoked the account's access and was attempting to contact the other maintainers to determine how many of them had approved commits without reviewing the actual code, a practice he described as 'extremely common' in his field.