A recent study has unveiled a troubling trend on GitHub, revealing that over 3.1 million fake “stars” have been used to artificially inflate the popularity of certain projects. This manipulation not only misleads users but also facilitates the distribution of scams and malware, ultimately compromising the integrity of the platform.
The role of stars on GitHub
Stars on GitHub function similarly to “likes” on social media, allowing users to bookmark repositories they find interesting. These stars contribute to a repository’s visibility and ranking, helping users discover related projects. However, as researchers from Socket, Carnegie Mellon University, and North Carolina State University have found, this system is being exploited.
Methodology of the study
The research team employed a tool named StarScout to sift through an extensive dataset from GHArchive, which contains metadata from over 6 billion GitHub events spanning from July 2019 to October 2024. By analyzing user activity patterns, StarScout identified accounts with minimal engagement—such as those that starred only one repository—and those exhibiting bot-like behavior.Through this analysis, the researchers identified approximately 4.5 million stars that appeared suspicious. After filtering for accuracy, they concluded that around 3.1 million of these were indeed fake, attributed to 278,000 accounts across nearly 16,000 repositories.
The surge in fake stars
The findings indicate a significant rise in fraudulent star activity in 2024, with about 15.8% of repositories having over 50 stars linked to these deceptive practices. Notably, about 91% of the identified repositories and 62% of the accounts have been removed by GitHub as of October 2024.
Implications for users
The proliferation of fake stars poses serious implications for GitHub’s user base. It undermines trust in the platform and its projects, making it essential for users to adopt a more discerning approach when evaluating repositories. Experts advise looking beyond star counts to assess a repository’s actual activity and quality by reviewing documentation and contributions.In light of these findings, it is crucial for users to remain vigilant when downloading software from GitHub, especially given the platform’s history of being exploited for malicious purposes.