  Security is critical to the adoption of open source software (OSS), yet few
automated solutions currently exist to help detect and prevent malicious
contributions from infecting open source repositories. On GitHub, a primary
host of OSS, repositories contain not only code but also a wealth of
commit-related and contextual metadata - what if this metadata could be used to
automatically identify malicious OSS contributions? In this work, we show how
to use only commit logs and repository metadata to automatically detect
anomalous and potentially malicious commits. We identify and evaluate several
relevant factors which can be automatically computed from this data, such as
the modification of sensitive files, outlier change properties, or a lack of
trust in the commit's author. Our tool, Anomalicious, automatically computes
these factors and considers them holistically using a rule-based decision
model. In an evaluation on a data set of 15 malware-infected repositories,
Anomalicious showed promising results and identified 53.33% of malicious
commits, while flagging less than 1% of commits for most repositories.
Additionally, the tool found other interesting anomalies that are not related
to malicious commits in an analysis of repositories with no known malicious
commits.
