# 4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Malware

**URL:** <https://forum.devtalk.com/t/4-5-million-suspected-fake-stars-in-github-a-growing-spiral-of-popularity-contests-scams-and-malware/182817>\
**Category:** In The News\
**Tags:** via-news-bot, github, malware, in-the-news\
**Created:** [3 January 2025 14:19 UTC](https://forum.devtalk.com/t/4-5-million-suspected-fake-stars-in-github-a-growing-spiral-of-popularity-contests-scams-and-malware/182817 "2025-01-03T14:19:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![CommunityNews](https://forum.devtalk.com/user_avatar/forum.devtalk.com/communitynews/32/1113_2.png) [@CommunityNews](https://forum.devtalk.com/u/CommunityNews)\
**Post date:** [3 January 2025 14:19 UTC](https://forum.devtalk.com/t/4-5-million-suspected-fake-stars-in-github-a-growing-spiral-of-popularity-contests-scams-and-malware/182817/1 "2025-01-03T14:19:03Z")

</div>

> 4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Malware.  
> GitHub, the de-facto platform for open-source software development, provides a set of social-media-like features to signal high-quality repositories. Among them, the star count is the most widely used popularity signal, but it is also at risk of being artificially inflated (i.e., faked), decreasing its value as a decision-making signal and posing a security risk to all GitHub users. In this paper, we present a systematic, global, and longitudinal measurement study of fake stars in GitHub. To this end, we build StarScout, a scalable tool able to detect anomalous starring behaviors (i.e., low activity and lockstep) across the entire GitHub metadata. Analyzing the data collected using StarScout, we find that: (1) fake-star-related activities have rapidly surged since 2024; (2) the user profile characteristics of fake stargazers are not distinct from average GitHub users, but many of them have highly abnormal activity patterns; (3) the majority of fake stars are used to promote short-lived malware repositories masquerading as pirating software, game cheats, or cryptocurrency bots; (4) some repositories may have acquired fake stars for growth hacking, but fake stars only have a promotion effect in the short term (i.e., less than two months) and become a burden in the long term. Our study has implications for platform moderators, open-source practitioners, and supply chain security researchers.

Read in full here:

> **[4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity...](https://arxiv.org/abs/2412.13459)**
>
> GitHub, the de-facto platform for open-source software development, provides a set of social-media-like features to signal high-quality repositories. Among them, the star count is the most widely used popularity signal, but it is also at risk of...

_This thread was posted by one of our members via one of our news source trackers._