Fake GitHub Stars and Open-Source Traction: What the Numbers Can Show

GitHub made it easier to discover open-source projects and participate in their communities. A star became a quick way to bookmark a project and signal interest. Over time, people also started treating star counts as a proxy for trust, adoption and business traction.

That creates an incentive to manipulate the number. A report from Awesome Agents examines fake stars, sellers and the way investors use GitHub activity as a signal: https://awesomeagents.ai/news/github-fake-stars-investigation/. I am concerned about what happens to open-source trust when a highly visible metric can be bought.

Some projects now reach audiences well beyond developers. I show the rapid growth of OpenClaw and comments from users who simply want an application download rather than source code. A broader audience can produce real growth in stars, so a sudden increase alone does not establish that anything was manipulated.

Investors may watch popular projects to discover new products and trends. A visible count is convenient when the underlying technology is unfamiliar. But once a metric influences attention or investment, some people have a reason to improve the appearance of the number instead of the underlying product.

The report points to an academic study using a detector called StarScout. Researchers analyzed GitHub event data from July 2019 through December 2024 and identified roughly six million suspected fake stars across 18,617 repositories. The paper and its methods are available at https://cmustrudel.github.io/papers/icse2026fakestars.pdf.

The word “suspected” matters. The researchers used activity patterns to identify campaigns and evaluated their detector against known cases and other signals. A flagged event is an estimate based on available data; the count is not a verified ledger of purchases or proof that every repository owner requested them.

The study found many suspected campaigns associated with short-lived malicious repositories as well as other categories, including AI and language-model projects. The report also notes that some flagged repositories appeared on GitHub Trending. That makes discovery an important concern, although appearing on a list does not by itself establish causation.

The report describes earlier experiments in which researchers purchased stars to study the market. Sellers advertised different prices and account histories. Those claims and experiments illustrate that a market exists; advertised delivery or survival rates should not be treated as independently verified guarantees.

The ecosystem discussed in the report extends beyond direct purchases to exchanges, accounts and fabricated activity. This matters because a public metric can be distorted in several ways. A number can be authentic in the sense that it is displayed by GitHub while still being a poor measure of genuine user interest.

I am frustrated with GitHub’s community moderation tools and describe my experience building moderation features at Twitch. That is my perspective and comes with its own bias. Platform operators face a hard problem: they need to preserve participation while detecting abuse and giving maintainers effective controls.

Awesome Agents also sampled 150 stargazer profiles for each of 20 repositories and compared account age, public repositories, followers and biographies. This is a separate, much smaller descriptive analysis from StarScout’s historical dataset. Its selection and sample size limit what it can establish.

An account with no public repositories, followers or biography might be a bot, but it might also belong to a real person who mainly reads or uses software. Account age and profile completeness are clues for investigation, not reliable labels of whether a specific user is genuine.

The report compares fork-to-star and watcher-to-star ratios between projects. Such ratios can help generate questions about unusual patterns, but a low fork rate does not mean nobody uses a project. Documentation, curated lists, applications and libraries attract different kinds of users and different behavior.

Several named projects in the report have unusual sample statistics. Those observations do not establish who caused any suspicious stars, whether a maintainer purchased them, or how much genuine adoption exists. Third parties can also target a repository, and an audience of newcomers can look different from an established developer audience.

I look at examples involving AI tools and note that I already like some of the people involved. That bias is worth disclosing. Neither my positive impression nor a profile sample is enough to clear or accuse a project; specific claims require a stronger investigation than a quick comparison of percentages.

The report cites an investor analysis of developer-tool companies and median star counts around funding rounds. It argues that public benchmarks create an incentive to inflate the metric. A correlation or median is not a funding requirement, and it does not show that buying stars causes an investment.

Calculating an apparent return by dividing a funding round by the advertised cost of stars assumes the fake stars caused the round. The report does not establish that causal chain. Funding depends on many factors, and an investment is not revenue or profit earned simply by purchasing a metric.

I disagree with several of the report’s company examples. In my experience, the discussions around Lovable and Browser Use involved more than star counts. I am an investor in both, and I passed on investments in Pangolin and LangChain; those relationships matter when evaluating my perspective.

For Browser Use, I saw substantial investor interest in its approach to browser automation and discussed keeping the team small. In the deals I was involved in, I do not recall stars being the deciding topic. That does not prove other investors ignore stars; it is a reason to question the report’s simplistic examples.

It is understandable for a young company to care about visible signs of interest, particularly before it has revenue. The danger comes when an easily manipulated proxy is treated as the thing it stands for. Investors can use stars to find a project, then investigate actual usage, product quality and the team.

The article proposes fork and watcher ratios as first-pass filters. They may help prioritize deeper review, but thresholds are not universal fraud detectors. Compare similar project types, examine the source and look at real discussions and contributions before reaching a conclusion.

Package download counts can also be inflated or distorted by automated installs, caches and build systems. A spike is worth investigating, but a download does not equal a distinct person or a paying customer. Different usage signals should be interpreted in the context of how they are collected.

The report discusses coordinated promotion on social platforms and suspicious repeated posts. I describe messages I received and sponsorship offers I declined. Repetitive content can be a reason to investigate, but it does not by itself establish a company’s responsibility for every account posting it.

I also explain that I rejected sponsorship offers when I did not trust the product or the arrangement. Those decisions reflect my own account and commercial judgment. More broadly, disclosure matters: audiences need to know when a creator has been paid or has a financial interest in what they discuss.

The video discusses US rules concerning fake indicators of social media influence. The FTC rule addresses certain knowing or should-have-known transactions involving fake indicators used to materially misrepresent influence for commercial purposes. Whether a particular GitHub star transaction falls within it depends on the facts and the law; the video does not establish a finding against any specific party.

The FTC explains the rule and its limits here: https://www.ftc.gov/business-guidance/resources/consumer-reviews-testimonials-rule-questions-answers. The report also mentions securities-fraud cases about fabricated business metrics. Those examples show that material misrepresentations can matter legally, but they do not prove that every suspicious star count is fraud.

I suspect some technology channels inflate views and show examples with unusually low likes and comments relative to views. Engagement ratios alone cannot prove fake traffic: audiences, distribution, video format and measurement vary. My examples are grounds for further examination, not verified findings about unnamed creators.

For advertisers, the sensible response is to verify performance across several signals instead of buying impressions at face value. Ask for appropriate campaign reporting, understand the audience and compare outcomes over time. I have my own commercial interest as a creator who sells sponsorships.

GitHub’s acceptable-use rules prohibit certain inauthentic interactions and attempts to manipulate rankings. The paper reports high deletion rates among flagged repositories and accounts by January 2025, but a deletion alone does not tell us who initiated the activity or why every individual account was removed.

Researchers suggest ways to make popularity measures less dependent on raw counts, including weighting signals using network structure. Account reputation and more transparent enforcement are other ideas. Each approach has tradeoffs: established users should not automatically count as more authentic than newcomers, and any public signal can itself be gamed.

For a more complete view of a project, look at contributor activity and retention, the quality of issues and discussions, release history, documentation and evidence of real usage. Package downloads can add context but are also susceptible to distortion. No single number is a substitute for examining the project.

The report describes a feedback loop: visible stars attract attention, and attention can create incentives to inflate the count. That is a plausible mechanism, not evidence that every startup or investor follows it. Better diligence and platform controls can make manipulation less rewarding.

My conclusion is to stop treating star totals as proof of quality, adoption or trust. They remain useful for discovery, but they are only the beginning of the investigation. Read the code and discussions, assess the evidence and be careful about claims built on an easily gamed number.