Understanding and Detecting GitHub Impersonation through Automated Authorship Attribution
GitHub is one of the largest open-source software (OSS) communities for development and collaboration. Impersonation maliciously assuming another user's identity to access code, sway projects, or spread misinformation—has driven recent real-world attacks and is an escalating concern. We present the first exploration of impersonation's impact on GitHub. Through structured interviews with 17 OSS contributors, we study perceptions and mitigations: users generally lack awareness and underestimate the risk; after a live demo, concern rises sharply. Current best practices (e.g., commit signing) need usability improvements to encourage adoption. We also assemble a dataset of 12.5 million commits to examine the current status of impersonation and the feasibility of repository-specific commit authorship attribution as a practical mitigation signal. Leveraging modern pretrained code models and verified commits as cryptographic ground truth, we evaluate whether repository-tuned predictors can infer likely authors and surface anomalous author commit pairs for human review. Models that leverage comprehensive commit information achieve high accuracy (e.g., over 96% with CodeT5+). Our metadata-only CrossCheck analysis shows that apparent author-history discrepancies are dominated by legitimate workflow confounders, so deterministic impersonation detection is unreliable without additional ground truth. We therefore evaluate repository-specific authorship attribution as a probabilistic triage signal, including robustness under a targeted style-imitation attack and open-set deployment considerations where the true author may be absent from the known contributor set. The results show that our approach improves stability over code-only attribution, strengthening its value as a practical triage signal under attacker adaptivity. While deterministic impersonation detection remains impossible, these probabilistic signals can help prioritize review and complement existing controls (e.g., commit signing and vigilant-mode alerts).