Did you know you could buy GitHub stars?
Carnegie Mellon just measured the market.
They analyzed 20TB of GitHub metadata. 6.7 billion events. 326 million stars from 2019 to 2024.
They found 6 million fake stars across 18,617 repositories from 301,000 accounts. Stars sell for $0.03 to $0.85 on open marketplaces. Redpoint's Jordan Segall pegged the median seed-round star count at 2,850. You can manufacture that for $285. A typical seed unlocks $1M to $10M.
That's the ROI: 117,000x at the top, 3,500x at the bottom.
Peak was July 2024:
-
16% of repositories with 50+ stars were contaminated
-
GitHub removed 90.4% of flagged repos
-
Only 57.1% of the delivering accounts got banned
The repos die. The sellers don't.
AI repos are the biggest target after malware. AI is crowded. Everyone wants to look credible. Stars are the cheapest way to fake it.
Stars aren't a quality signal anymore. They're a fraud signal.
One check still works: fork-to-star ratio. Organic projects sit at 0.15 to 0.20. Faked ones drop below 0.05. This check will get gamed too.
Before I pull in a library, I check the basics: age, open issues, maintainer count, last commit date.
Stars compress to nothing. Commits compress to trust. Audit the graph, not the badge.
Source: https://arxiv.org/abs/2412.13459