UC Riverside

How can we mine the socio-technical activities of an open-source platform like GitHub? Specifically, how can we (a) identify repositories of interest, (b) study a community of interest at scale, and (c) connect users of interest beyond the platform’s boundaries? GitHub is the largest public software-hosting platform, with over 180 million developers and 630 million repositories as of 2025, yet the research community still lacks general-purpose capabilities to navigate its socio-technical surface end-to-end. The public surface of GitHub exposes far more actionable information than its native search and APIs reach, but extracting it requires methods that scale to the platform. This thesis spans three interrelated problems. First, we propose RepoScope, a multi-granularity query-by-example framework for GitHub repository search. RepoScope introduces three pre-crawled levels of granularity (292M repositories with minimal metadata, 1.46M with full metadata, and 50.5K with metadata and source code) and combines them with an embedding-based retrieval pipeline and a clustering layer with interpretable summaries. RepoScope outperforms the GitHub REST API on 70% of queries and matches or exceeds it on 94% of cases, achieving an average top-10 precision of 86% and a 100% success rate on its largest dataset. Second, we propose MAGNET, a systematic framework for studying malicious-intent malware repositories on GitHub as a software ecosystem. MAGNET integrates three stages: (a) an LLM-agent pipeline that identifies malicious-intent repositories by combining repository-level evidence with the author’s portfolio, (b) a three-level taxonomy of engineering archetypes, and (c) three participation roles (co-developer, supporter, follower) that model how users engage. MAGNET identifies 3,598 malicious-intent repositories from 16,726 candidates with 97% human-validated precision, shows that 80.24% are ephemeral one-shot uploads, and uncovers an active community of approximately 51K users across 711 repositories in which following dominates co-development. Third, we propose GeekMAN, a human-inspired approach to identify similar usernames across online platforms with a focus on technogeek users on security forums and GitHub. GeekMAN integrates (a) decomposing usernames into chunks, (b) de-obfuscating slang conventions, and (c) exhaustively comparing the resulting decompositions to score similarity. On technogeek datasets spanning 1.8M usernames from GitHub and five hacker-rich security forums, GeekMAN matches with 81–86% precision, against 46–78% for two state-of-the-art baselines, and identifies 6,327 security-forum users that match malware authors on GitHub. Together, these contributions form a systematic suite of methods and tools for mining the socio-technical activities of an open-source platform and enable studies that were previously out of reach