Perhaps I misunderstood. But isn't Github help you filter out such candidates, is it? They have some big projects, but their contribution calandar should be almost empty, cuz all the code is pushed into Github at once.
No one should look at the contribution calendar and hire based on it without looking more in depth. To answer your question it's based on commit time, but because of that you have things like: https://github.com/gelstudios/gitfiti
To all the down-voters, let me rephrase my opinion again. I do take serious look on candidates Github profile, if they include that in their resume. And if they has some reasonable big projects, but they calendar seems empty, I will immediately think that the code is not belong to them. Perhaps that just forks, or, worse, that are stolen code.
I would also check they PR, issue and comments, to get some idea about how they work with stranger; what are important to them when they suggest ideas, contribute to existing code base; how they reply to critic or question from project owner, etc.
Also, just my opinion, most of us - software developers - can't live without OSS. We should contribute back when we could. That's why I usually prefer resume with a non empty Github profile than the others.