Skip to content
#Humor

Over 3.1 million fake "stars" on GitHub projects used to boost rankings (Humor column)

#Humor #Software #Management

I read it today. article It's about scaling up GitHub. In fact, here is about the same problem as in other social networks, where popularity, likes and stars bring their owners additional value. At GitHub, such a value is that the stars are perceived as a proxy metric of the popularity of the project in the community and its future prospects. It appeared in mid-December. study Carnegie Mellon University, Socket Inc, North Carolina State University. In it, scientists first developed an instrument called StarScout, which they analyzed. 20 TB of GitHub data was originally discovered 4,5 A million suspicious stars 1,32 A million accounts. After filtration to improve accuracy, the final count showed 3,1 A million fake stars from 278 000 account 15 835 repositories. The results of the study show that the problem has reached a peak in the 2024 about a year when 15,8Percentage of repositories with more 50 star 2024 They were involved in these deceptive practices. The effectiveness of the StarScout detection tool was confirmed by the fact that by October 2024 GitHub Removed the Year 91Percentage of suspicious repositories identified and 62Percentage of inauthentic accounts.

Here is a list of findings by the study authors

Research Question 1: How prevalent are fake stars in GitHub?

  1. Fraudulent starring activities start to gain momentum in 2022 and have been surging since 2024.
  2. Even a small portion of fake stargazers can greatly distort stars as a repository popularity signal.
  3. Only a few repositories with fake star campaigns are published in package registries such as npm and PyPI. Even fewer are widely adopted. Research Question 2: What are the characteristics of GitHub repositories with fake star campaigns?
  4. Most repositories with fake star campaigns are short-lived (only a few days of activity).
  5. The majority of GitHub repositories with fake star campaigns seem related to pirated software, game cheats, and cryptocurrency bots. However, it is likely that they are actually malware clickbaits. Research Question 3: What are the characteristics of GitHub accounts that participated in fake star campaigns?
  6. Compared to average GitHub users, accounts in fake star campaigns are slightly more likely to have an empty profile, but the differences are relatively small.
  7. At least 60% of the accounts that participated in fake star campaigns have trivial activity patterns. Research Question 3: To what extent are fake stars effective in promoting the target GitHub repositories?
  8. Buying fake stars may help a repository gain real attention in the short-term future (i.e., less than two months), but the effect is 3–4x smaller compared to real stars; it has a negative effect in the long term. As a result, we conclude that stars are an unreliable signal for those who practice using or countering open-source. You need to use other signals, for example, from OpenSSF Scorecard, for which there is a separate signal. whitepaper.

#Software #Management