Fake stars on GitHub: what our filter catches
Stars are cheap to buy, and bought stars push repos into trending lists, sometimes with malware inside. Every repo that rises on RepoAlerts goes through a filter first. These are its numbers, updated hourly.
The numbers today
- Repos we track
- 18,310
- Checked in depth
- 87
- Flagged and left out
- 43
- Stars on flagged repos
- 597,769
- Stars they gained this week
- 59,206
- Would be in today's top 25
- 1
- Would be in this week's top 25
- 1
- Removed by hand after review
- 7
How we spot them
Who starred it · 6 flagged
We sample the accounts that starred the repo from GitHub's public event archive. When many were created days before starring, have no followers and no repos, or starred within the same few minutes, the stars aren't people.
The shape of the curve · 1 flagged
A real launch rises and then keeps a tail. Bought stars arrive as a spike of hundreds and then nothing, with almost no forks or watchers.
Same owner, many hits · 17 flagged
Three or more repos from one account, created within a month, each passing a thousand stars with no outside attention (no Hacker News, no press).
Twins · 19 flagged
Five or more repos from different accounts, created within two hours, with almost the same number of stars and no forks: one farm working several orders at once.
What happens to a flagged repo
It stays out of the rankings, the sky, the directory and the emails. Nothing is deleted: if the stars turn out to be real, it comes back on its own at the next check, and any maintainer can ask for a review.
We don't publish a list of flagged repos. A signal can be wrong, and a public list would point at people who may have done nothing; the numbers are enough to show the size of the problem.
Think your repo was flagged by mistake? Write to hola@repoalerts.com and we'll look at it by hand.
Why it matters
Researchers from Carnegie Mellon University, North Carolina State University and Socket counted millions of suspected fake stars on GitHub, and found repos with bought stars reaching GitHub Trending, some of them spreading malware.