GitHub, the largest public code repository in the world, is currently battling against the largest and most gnarly distributed denial of service (DDoS) attack in the site's history. The attack started on Thursday morning (March 26) and has continued unabated since then, evolving several times to circumvent GitHub's defenses. The ongoing attack appears to originate from China, with the DDoS specifically targeting two GitHub projects that are designed to combat censorship in China: GreatFire, and cn-nytimes, a Chinese language version of The New York Times.

According to a security researcher at Insight Labs, the DDoS is being caused by some nefarious JavaScript that is being injected by "a certain device at the border of China's inner network and the Internet" when people visit the Baidu search engine. The JavaScript tells the user's browser to request two GitHub URLs: https://github.com/greatfire/ and https://github.com/cn-nytimes/. Multiply that by millions of Baidu users, and voilà: a DDoS on GitHub.

87 hours in, our mitigation is deflecting most attack traffic. We're aware of intermittent issues and continue to adapt our response. — GitHub Status (@githubstatus) March 29, 2015

The GitHub Status page gives us some insight into the ongoing attack. GitHub has managed to get successful mitigations into place several times, but it's still all-hands-on-deck as the attack continues to evolve. If you look at the longer-term status graphs, you can see spikes of reduced availability/higher latency on March 26, 27, and 28, but for the most part it looks like the DDoS has been mostly quashed for now.

The DDoS attack has evolved and we are working to mitigate — GitHub Status (@githubstatus) March 30, 2015

Baidu denies any involvement in the attack and says its own internal security hasn't been compromised. “After careful inspection by Baidu’s security engineers, we have ruled out the possibility of security problems or hacker attacks on our own products,” the company said in a statement.

There is currently no indication of who is responsible for the attack, though the highly specific targeting of the attack would indicate that the bad actor isn't a fan of tools or services that can circumvent censorship in China. We will probably get an official statement after the attack is fully under control, but for now GitHub isn't saying anything specific: “Based on reports we’ve received, we believe the intent of this attack is to convince us to remove a specific class of content."