Over 3.1 Million Fake GitHub Stars Used to Boost Rankings (Category Humor)

Today I read an article about artificially inflating GitHub rankings. It is much the same problem as on other social networks, where popularity, likes and stars create value for their owners. On GitHub, stars are treated as a proxy for a project’s popularity in the community and its future prospects. A study by Carnegie Mellon University, Socket Inc and North Carolina State University appeared in mid-December. The researchers developed StarScout, analysed 20 TB of GitHub data and initially found 4.5 million suspicious stars from 1.32 million accounts. After filtering to improve precision, the final count was 3.1 million fake stars from 278 000 accounts across 15 835 repositories. The study found that the problem peaked in 2024: roughly 15.8% of repositories with more than 50 stars in July 2024 were involved in these practices. By October 2024, GitHub had removed 91% of the suspicious repositories and 62% of the inauthentic accounts identified, supporting the effectiveness of StarScout’s detection.

Here are the authors’ findings:

Research Question 1: How prevalent are fake stars in GitHub?

1. Fraudulent starring activities start to gain momentum in 2022 and have been surging since 2024.
2. Even a small portion of fake stargazers can greatly distort stars as a repository popularity signal.
3. Only a few repositories with fake star campaigns are published in package registries such as npm and PyPI. Even fewer are widely adopted. Research Question 2: What are the characteristics of GitHub repositories with fake star campaigns?
4. Most repositories with fake star campaigns are short-lived (only a few days of activity).
5. The majority of GitHub repositories with fake star campaigns seem related to pirated software, game cheats, and cryptocurrency bots. However, it is likely that they are actually malware clickbaits. Research Question 3: What are the characteristics of GitHub accounts that participated in fake star campaigns?
6. Compared to average GitHub users, accounts in fake star campaigns are slightly more likely to have an empty profile, but the differences are relatively small.
7. At least 60% of the accounts that participated in fake star campaigns have trivial activity patterns. Research Question 3: To what extent are fake stars effective in promoting the target GitHub repositories?
8. Buying fake stars may help a repository gain real attention in the short-term future (i.e., less than two months), but the effect is 3–4x smaller compared to real stars; it has a negative effect in the long term.

The conclusion is that stars are an unreliable signal for people using or contributing to open source. Other signals are needed too, such as OpenSSF Scorecard, which has its own whitepaper.

#Software #Management