Pattern 41: The Mechanical Horde - Automated Repository Saturation

Patrick Duggan · Nov 24, 2025 · 3 min read

Pattern ID: 41
Category: Platform Abuse
Severity: MEDIUM

The Soundtrack

Because every good threat hunt deserves a metal anthem:

The Discovery

While investigating GitHub supply chain threats (Pattern 38), we discovered something peculiar: accounts creating hundreds of repositories with mechanical precision - every 2-15 seconds, like clockwork.

Meet siagfnd and barrylustig - two accounts that created 810 and 827 repositories respectively, with timing so precise it screams "automation."

The Technical Signature

What makes this a bot?

Timestamp Analysis:
14:24:26 - vigilant-fortnight
14:24:29 - ideal-giggle (+3 sec)
14:24:31 - cuddly-invention (+2 sec)
14:24:33 - laughing-octo-spoon (+2 sec)

• 827 repositories

• 98.97% mechanical timing (96 out of 97 creation intervals were 2-15 seconds)

• Average interval: 4.97 seconds

• Zero public events

• Zero followers

• 99%+ null language (no actual code)

• 810 repositories

• Created in 11 months (73 repos/month)

• Mechanical timing: 2-13 second intervals

• Zero engagement, all auto-generated names

Why This Matters

Namespace Saturation creates a false baseline for the GitHub ecosystem:

1. Cognitive Overload - Defenders can't review 810 repos individually
2. False Consensus - Makes mass repo creation appear "normal"
3. Camouflage - Malicious repos (Pattern 38 sleepers) blend into the noise
4. Search Pollution - Legitimate projects harder to find

Kill the Body, Ignore the Heads

The Hydra Metaphor applies here:

❌ FUTILE: Delete 810 individual repos (bot creates more)
✅ EFFECTIVE: Report automation infrastructure to GitHub

Reporting individual repos is pointless. The API token that creates them is the real threat. GitHub can suspend the account and investigate the bot network.

The Detection

Our new Pattern 41 scanner uses timestamp analysis:

detectMechanicalTiming(repos) {
  // Calculate intervals between repo creation
  const intervals = [];
  for (let i = 1; i < timestamps.length; i++) {
    const intervalSec = (timestamps[i] - timestamps[i-1]) / 1000;
    if (intervalSec < 60) intervals.push(intervalSec);
  }

// Check for mechanical precision (2-15 sec intervals)
const mechanicalIntervals = intervals.filter(i => i >= 2 && i <= 15);
const mechanicalRatio = mechanicalIntervals.length / intervals.length;

return { isMechanical: mechanicalRatio > 0.7 }; // 70%+ = bot
}
```

barrylustig: 98.97% mechanical ratio → CONFIRMED BOT

The Bot Network

This isn't isolated. We've identified multiple accounts with similar patterns:

• 500-1000+ repos per account

• Mechanical timing (2-15 second intervals)

• Zero engagement (0 public events, 0 followers)

• Burst creation (100+ repos in minutes)

• Null language (99%+ empty repos)

Automated Detection & Disclosure

We've deployed:

1. pattern-38-scanner.js - Daily automated detection
2. Ethical disclosure pipeline - Feed subscribers get IOCs FIRST (5-minute grace period), then public disclosure
3. STIX feed integration - `https://analytics.dugganusa.com/api/v1/stix-feed`

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

Philosophy: Protect subscribers first. Shame bad actors second. That's the order.

Evidence Package

• Account: siagfnd (User ID: 194684488)

• Account: barrylustig (User ID: 11999741)

• Violation: Terms of Service - Automated Mass Repository Creation

• Evidence: Mechanical timing analysis, zero engagement, namespace pollution

• Requested Action: Account suspension, API key investigation, bot network analysis

Detection Summary

• 500-1000+ repositories

• Mechanical timing (2-15 second intervals)

• 99%+ null language (no code)

• 0 public events

• 0 followers

• All auto-generated repository names

• Burst creation (100+ repos/day)

Confidence: HIGH - automated saturation bot
Action: Report to GitHub for ToS violation (mass automation)

Resources

• Pattern Documentation: `/patterns/pattern-41-automated-repository-saturation.json`

• Automation Guide: `/docs/PATTERN-38-AUTOMATION-GUIDE.md`

• STIX Feed: `https://analytics.dugganusa.com/api/v1/stix-feed`

• GitHub Actions: Daily scans at 06:00 UTC

Lessons Learned

1. Timestamp analysis reveals automation - Mechanical precision is the signature
2. Volume matters - 810 repos in 11 months = automated
3. Zero engagement = red flag - No human creates 810 repos without interaction
4. Kill the body, not the heads - Report infrastructure, not individual repos
5. Automate the boring stuff - Daily scans protect the ecosystem

Attribution: Patrick Duggan / DugganUSA LLC
License: CC BY 4.0 (Creative Commons Attribution)
Evidence: Compliance records available in repository

Making the Internet Safer, Automatically ✅

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=pattern-41-the-mechanical-horde-automated-repository-saturation