Over 3.1 million fake "stars" on GitHub projects used to boost rankings

Researchers from Socket, Carnegie Mellon University, and North Carolina State University used the StarScout tool to analyze GHArchive data and uncovered approximately 4.5 million suspected fake GitHub stars from 1.32 million accounts across nearly 23,000 repositories, later refined to 3.1 million fake stars across 15,835 repositories. The study shows a surge in 2024 activity, widespread deletions by October 2024 that validate the findings, and highlights how inauthentic stars help elevate scam and malware-hosting repositories; users are urged to assess repository quality beyond star counts.