CoChat
Sign Up
Cited by 2Spam and Phishing DetectionSoftware Engineering ResearchOpen Source Software Innovations

Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware

Open access
He, Hao, Yang, Haoqin, Burckhardt, Philipp, Kapravelos, Alexandros, Vasilescu, Bogdan, Kästner, Christian·2026·Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering
DOI 10.1145/3744916.3764531

Published version of a preprint

Open this paper in CoChat — free account

Abstract

GitHub, the de facto platform for open-source software development, provides a set of social-media-like features to signal high-quality repositories. Among them, the star count is the most widely used popularity signal, but it is also at risk of being artificially inflated (i.e., faked), decreasing its value as a decision-making signal and posing a security risk to all GitHub users. In this paper, we present a systematic, global, and longitudinal measurement study of fake stars in GitHub. To this end, we build StarScout, a scalable tool able to detect anomalous starring behaviors across all GitHub metadata between 2019 and 2024. Analyzing the data collected using StarScout, we find that: (1) fake-star-related activities have rapidly surged in 2024; (2) the accounts and repositories in fake star campaigns have highly trivial activity patterns; (3) the majority of fake stars are used to promote short-lived phishing malware repositories; the remaining ones are mostly used to promote AI/LLM, blockchain, tool/application, and tutorial/demo repositories; (4) while repositories may have acquired fake stars for growth hacking, fake stars only have a promotion effect in the short term (i.e., less than two months) and become a liability in the long term. Our study has implications for platform moderators, open-source practitioners, and supply chain security researchers.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper presents StarScout, a scalable detector of anomalous starring behavior across all GitHub metadata from July 2019 to December 2024, identifying 6.0 million suspected fake stars and 18,617 repositories with fake star campaigns. It finds fake-star activity surged in 2024, is often tied to short-lived phishing/malware or spam repositories, and has only short-term promotional value.

Key findings

  • StarScout identified 6.0 million suspected fake stars and 18,617 repositories with fake star campaigns; after postprocessing, 301k participating accounts corresponded to 3.81 million fake stars. Fake stars remained ≤1% of all GitHub stars each month, but campaigns surged in 2024: in July 2024, 16.66% of popular repositories (3,499) had fake star campaigns, and in March 2024, 6.59% of active accounts (117,024) were in fake star campaigns.
  • Against the Stargazer Ghost Network malware campaign, StarScout detected 688 of 847 repositories (81.23%) and 11,903 of 15,672 accounts (75.95%). Detected repositories and accounts had much higher deletion rates than baselines: 90.42% of repositories and 57.07% of accounts in fake star campaigns were deleted, versus 5.03% of random repositories and 3.54% of random accounts.
  • Most repositories with fake star campaigns were short-lived: 83.90% had less than ten days of activity. Of repositories still accessible, Spam/Phishing was the most common category (22.6% overall; 31.1% in the “Other” group), followed by AI/LLM (16.6%), Blockchain (13.1%), Tool/Application (12.6%), and Tutorial/Demo (12.1%). Only 78 (0.42%) reached GitHub Trending, and 229 (1.23%) were linked to package registries (738 packages), with 70.46%/77.50% having no dependent package/repository.
  • Fake stars had a short-term but much weaker promotional effect than real stars. A 1% increase in real stars was associated with a 0.36% increase in real stars the next month, 0.15% at month t+2, and 0.10% thereafter; a 1% increase in fake stars was associated with a 0.07% increase at t+1 and 0.03% at t+2, but a 0.04% decrease on average from t+2 onward—about 5x smaller short-term effect and negative long-term effect.

Methods

  • Built StarScout to scan all GHArchive GitHub event data from July 2019 to December 2024 (63.9 million users, 331 million repositories, 326 million stars, and 6.7 billion other events as of January 2025). It detects a low-activity signature and a lockstep signature, implements CopyCatch with parameters n=50, m=10, Δt=30 days, ρ=0.5, and applies postprocessing to identify repositories with fake star campaigns.
  • Evaluated recall against the Stargazer Ghost Network dataset (847 repositories, 15,672 suspicious accounts) and estimated criterion validity by comparing deletion rates of detected repositories/accounts with random samples (10,000 repositories with ≥50 stars and 10,000 stargazers).
  • Measurement study covered prevalence, activity patterns (CCDF and k-means clustering), repository characteristics (open coding of READMEs, with GPT-o3-mini as second coder; Cohen’s κ=0.71), and promotional effect using panel autoregression models (AR(2) fixed- and random-effects, 12,738 observations).

Limitations

  • The paper states that StarScout detects suspected fake stars and that its evidence alone is insufficient for disciplinary action; false positives are possible, and the detector relies on ad-hoc heuristics and parameters—notably the 50-star threshold—without thorough sensitivity tests. It also notes ethical concerns about potentially harming repositories through false accusations.
  • The paper states that the panel autoregression models cannot establish causality, that Granger causality tests were not feasible because most time series were too short, and that exogenous variables may hide real causal mechanisms.
  • Evident from the text: deleted repositories become inaccessible and GHArchive stores no repository content, limiting analysis of the 90.42% deleted repositories; open coding may miss better-obfuscated malicious repositories; and the LLM second coder may fail to recognize obfuscated phishing repositories with seemingly legitimate READMEs.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1145/3744916.3764531

Cites

68 of 68 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

20 of 79 cited sources checked · 10 supported · 0 flagged · accuracy not yet measured

  • Premisecitation
    § 1 Introduction · p. 1

    The number of GitHub stars is widely used when stakeholders evaluate, select, and adopt open-source projects into their software supply chain.

    “Many studies provided evidence that the number of GitHub stars is widely used when stakeholders evaluate, select, and adopt opensource projects into their software supply chain [33, 61, 71, 76, 89, 95].”
    Quote in the paperSubstantial claim4 of 6 sources checked
    • cites [33] [33] Hudson Borges and Marco Túlio Valente. 2018. What's in a GitHub Star? Understanding Repository Starring Practices in a Social Coding Platform. J. Syst. Softw. 146 (2018), 112-129. - source
    • cites [61] [61] Simon Koch, David Klein, and Martin Johns. 2024. The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code. In MADWeb: Workshop on Measurements; Attacks and Defenses for the Web . - source

      The Introduction says security researchers commonly use GitHub stars to select applications or libraries as research targets. It does not establish that stakeholders generally use stars to evaluate or adopt open-source projects into their software supply chains; the Background explicitly leaves the connection between stars and usage open. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites [71] [71] Nuthan Munaiah, Steven Kroh, Craig Cabrey, and Meiyappan Nagappan. 2017. Curating GitHub for engineered software projects. Empir. Softw. Eng. 22, 6 (2017), 3219-3253. - source
    • cites [76] [76] Huilian Sophie Qiu, Yucen Lily Li, Hema Susmita Padala, Anita Sarma, and Bogdan Vasilescu. 2019. The Signals that Potential Contributors Look for When Choosing Open-source Projects. Proc. ACM Hum. Comput. Interact. 3, CSCW (2019), 122:1-122:29. - source

      Section 2.3 (page unavailable) reports that three out of four surveyed developers considered GitHub stars before using or contributing to a project. Section 4.7 (page unavailable) also describes stars as a popularity signal considered by interview participants. The paper does not establish that stars are widely used specifically to select and adopt projects into a software supply chain. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites [89] [89] Enrique Larios Vargas, Maurício Finavaro Aniche, Christoph Treude, Magiel Bruntink, and Georgios Gousios. 2020. Selecting third-party libraries: The practitioners' perspective. In ESEC/FSE '20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Virtual Event, USA, November 8-13, 2020 . ACM, 245-256. - source

      In 3.2 Human Factors (p. 6), the paper reports that three interviewees used star counts when selecting libraries, while most considered popularity influential. This supports star counts as one selection metric, but not the broader claim that GitHub stars are widely used across stakeholders evaluating and adopting open-source projects. (LLM, conf=0.84)

      Experimental — accuracy not yet measured
    • cites [95] [95] Dominik Wermke, Noah Wöhler, Jan H. Klemmer, Marcel Fourné, Yasemin Acar, and Sascha Fahl. 2022. Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022 . IEEE, 1880-1896. - source
  • Premisecitation
    § 1 Introduction · p. 2

    Malicious actors continuously evolve their behaviors to evade platform detection.

    “malicious actors continuously evolve their behaviors to evade platform detection [40, 58]”
    Quote in the paperNot a substantial claim2 of 2 sources checked
    • cites [40] [40] Stefano Cresci, Roberto Di Pietro, Marinella Petrocchi, Angelo Spognardi, and Maurizio Tesconi. 2017. The Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race. In Proceedings of the 26th International Conference on World Wide Web Companion . ACM, 963-972. - source
    • cites [58] [58] Muhammad Ikram, Lucky Onwuzurike, Shehroze Farooqi, Emiliano De Cristofaro, Arik Friedman, Guillaume Jourjon, Mohamed Ali Kâafar, and M. Zubair Shafiq. 2017. Measuring, Characterizing, and Detecting Facebook Like Farms. ACM Trans. Priv. Secur. 20, 4 (2017), 13:1-13:28. - source

      The Roadmap (p. 2) says stealthier like farms circumvent detection by spreading likes over longer periods and mimicking normal users. Timeline-based Detection (p. 15) describes evasion as an arms race, but the paper does not establish that malicious actors generally or continuously evolve their behavior over time. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
  • Premisecitation
    § 5.1 Open-Source Practitioners · p. 10

    Practitioners use star counts as an important (and often the most important) signal for decisions, including high-stakes decisions like open-source component adoption and repository reputation evaluation.

    “Yet, study after study shows how practitioners use star counts as an important (and often as the most important) signal for all kinds of decisions, including high-stakes decisions like open-source component adoption [69, 89, 95] and repository reputation evaluation [76, 88].”
    Quote in the paperSubstantial claim1 of 3 sources checked
    • cites [69] [69] Suhaib Mujahid, Rabe Abdalkareem, and Emad Shihab. 2023. What are the characteristics of highly-selected packages? A case study on the npm ecosystem. J. Syst. Softw. 198 (2023), 111588. - source
    • cites [89] [89] Enrique Larios Vargas, Maurício Finavaro Aniche, Christoph Treude, Magiel Bruntink, and Georgios Gousios. 2020. Selecting third-party libraries: The practitioners' perspective. In ESEC/FSE '20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Virtual Event, USA, November 8-13, 2020 . ACM, 245-256. - source

      In 3.2 Human Factors (p. 6), the paper reports that practitioners consider library popularity when selecting third-party libraries and that three interviewees use star counts as one measure. It does not establish that star counts themselves are often the most important signal; the reported influence ratings concern popularity more broadly. The repository-reputation portion of the citing sentence is attached to other citations, not this paper. (LLM, conf=0.88)

      Experimental — accuracy not yet measured
    • cites [95] [95] Dominik Wermke, Noah Wöhler, Jan H. Klemmer, Marcel Fourné, Yasemin Acar, and Sascha Fahl. 2022. Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022 . IEEE, 1880-1896. - source
  • Premisecitation
    § 5.1 Open-Source Practitioners · p. 10

    Stars on GitHub are not a reliable signal.

    “Our study is far from the first showing that stars on GitHub are not a reliable signal [2, 56, 61, 80].”
    Quote in the paperSubstantial claim2 of 3 sources checked
    • cites [2] [2] 2019. Can we trust GitHub stars? Retrieved July 9, 2024 from https://traefik.io/ blog/can-we-trust-github-stars-e8aa8b6b0baa/ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [56] [56] Runzhi He, Hengzhi Ye, and Minghui Zhou. 2024. Revealing the Value of Repository Centrality in Lifespan Prediction of Open Source Software Projects. CoRR abs/2405.07508 (2024). arXiv:2405.07508 - source
    • cites [61] [61] Simon Koch, David Klein, and Martin Johns. 2024. The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code. In MADWeb: Workshop on Measurements; Attacks and Defenses for the Web . - source

      Section A, “Untrustworthy Connection Between Project and Repository” (page unavailable), says star counts for registry projects cannot be taken at face value. But Section C, “Correlations” (page unavailable), describes stars as moderately strong predictors of deployments for the client-side JavaScript libraries studied. The unqualified claim that GitHub stars are not a reliable signal overstates the paper’s findings. (LLM, conf=0.87)

      Experimental — accuracy not yet measured
  • Premisecitation
    § 4.4 RQ4: Promotional Effect · p. 9

    The remaining three control variables have been shown to correlate with star increases in prior work.

    “the remaining three are control variables that have been shown to correlate with star increases in prior work [49]”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [49] [49] Hongbo Fang, Hemank Lamba, James D. Herbsleb, and Bogdan Vasilescu. 2022. "This Is Damn Slick!" Estimating the Impact of Tweets on Open Source Project Popularity and New Contributors. In 44th IEEE/ACM 44th International Conference on Software Engineering, ICSE 2022 . ACM, 2116-2129. - source
  • Classified as probably not a substantial claim. 35
  • May combine two claims. 46
  • The quote only partly states this claim. 1

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 2.1 Fraudulent Activities in Social Networks · p. 2

    Facebook Like farms are still able to maneuver through detection techniques by mimicking realistic user activities and violating the techniques' built-in assumptions.

    “Ikram et al. [58] show that the Facebook Like farms are still able to maneuver through these techniques by mimicking realistic user activities and violating the techniques' built-in assumptions (e.g., assuming that fake Likes happen in bursts [30]).”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [58] [58] Muhammad Ikram, Lucky Onwuzurike, Shehroze Farooqi, Emiliano De Cristofaro, Arik Friedman, Guillaume Jourjon, Mohamed Ali Kâafar, and M. Zubair Shafiq. 2017. Measuring, Characterizing, and Detecting Facebook Like Farms. ACM Trans. Priv. Secur. 20, 4 (2017), 13:1-13:28. - source

  • May combine two claims.

    Premisecitation
    § 1 Introduction · p. 1

    The number of GitHub stars is merely a popularity signal, with only moderate correlation to actual usage or importance.

    “it is merely a popularity signal (i.e., the attention received from GitHub users), with only moderate correlation to actual usage or importance as shown in prior studies [56, 61, 80].”
    Quote in the paperSubstantial claim3 of 3 sources checked
    • cites [56] [56] Runzhi He, Hengzhi Ye, and Minghui Zhou. 2024. Revealing the Value of Repository Centrality in Lifespan Prediction of Open Source Software Projects. CoRR abs/2405.07508 (2024). arXiv:2405.07508 - source

      In “Defining Repository Centrality” (page unavailable), the paper calls stars indicators of popularity and attention. “Preliminary Analysis” (page unavailable) reports a moderate correlation between star counts and HITS repository-centrality scores, and argues that star counts do not reliably represent project impact. It does not measure a moderate correlation between stars and actual usage or importance, so that part of the claim goes beyond the reported result. (LLM, conf=0.85)

      Experimental — accuracy not yet measured
    • cites [61] [61] Simon Koch, David Klein, and Martin Johns. 2024. The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code. In MADWeb: Workshop on Measurements; Attacks and Defenses for the Web . - source
    • cites [80] [80] William Schueller and Johannes Wachs. 2024. Modeling interconnected social and technical risks in open source software ecosystems. Collective Intelligence 3, 1 (2024), 26339137241231912. - source

      The Rankings section (page unavailable) defines GitHub stars as a measure of popularity or social visibility, distinct from downloads as a measure of use. The Introduction (page unavailable) reports a Spearman correlation of about 0.42 between stars and the paper’s measure of systemic importance among the top 1,000 Rust libraries. Our copy does not report a correlation between stars and actual usage, so that part of the claim is unsupported. (LLM, conf=0.86)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 2.1 Fraudulent Activities in Social Networks · p. 2

    Some providers generate fake popularity signals using automated bots, while others use realistic accounts and even crowdsourced real humans.

    “some providers generate fake popularity signals using automated bots (aka. sybils), but some others use realistic accounts and even crowdsourced real humans (aka. crowdturfing) [58, 83, 84, 93, 100].”
    Quote in the paperNot a substantial claim1 of 5 sources checked
    • cites [58] [58] Muhammad Ikram, Lucky Onwuzurike, Shehroze Farooqi, Emiliano De Cristofaro, Arik Friedman, Guillaume Jourjon, Mohamed Ali Kâafar, and M. Zubair Shafiq. 2017. Measuring, Characterizing, and Detecting Facebook Like Farms. ACM Trans. Priv. Secur. 20, 4 (2017), 13:1-13:28. - source
    • cites [83] [83] Jonghyuk Song, Sangho Lee, and Jong Kim. 2015. CrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, October 12-16, 2015 . ACM, 793-804. - source
    • cites [84] [84] Gianluca Stringhini, Gang Wang, Manuel Egele, Christopher Kruegel, Giovanni Vigna, Haitao Zheng, and Ben Y. Zhao. 2013. Follow the green: Growth and dynamics in Twitter follower markets. In Proceedings of the 2013 Internet Measurement Conference, IMC 2013 . ACM, 163-176. - source
    • cites [93] [93] Gang Wang, Christo Wilson, Xiaohan Zhao, Yibo Zhu, Manish Mohanlal, Haitao Zheng, and Ben Y. Zhao. 2012. Serf and turf: Crowdturfing for fun and profit. In Proceedings of the 21st World Wide Web Conference 2012, WWW 2012, Lyon, France, April 16-20, 2012 . ACM, 679-688. - source
    • cites [100] [100] Zhi Yang, Christo Wilson, Xiao Wang, Tingting Gao, Ben Y. Zhao, and Yafei Dai. 2014. Uncovering social network Sybils in the wild. ACM Trans. Knowl. Discov. Data 8, 1 (2014), 2:1-2:29. - source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 2.1 Fraudulent Activities in Social Networks · p. 2

    Supervised machine learning models for fraud detection can be evaded by malicious actors if they change their behaviors over time.

    “these models can be evaded by malicious actors if they change their behaviors over time [40, 92]”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites [40] [40] Stefano Cresci, Roberto Di Pietro, Marinella Petrocchi, Angelo Spognardi, and Maurizio Tesconi. 2017. The Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race. In Proceedings of the 26th International Conference on World Wide Web Companion . ACM, 963-972. - source

      The Introduction (p. 1) says that standard classification approaches no longer succeed against a new wave of evolving social spambots. In Established Techniques (p. 6), a supervised classifier labels those spambots as genuine accounts. The evidence supports evasion in social-spambot detection, but does not establish the claim for fraud-detection models generally. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites [92] [92] Gang Wang, Tianyi Wang, Haitao Zheng, and Ben Y. Zhao. 2014. Man vs. Machine: Practical Adversarial Detection of Malicious Crowdsourcing Workers. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014 . USENIX Association, 239-254. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 5.4 Researchers · p. 11

    Software supply chain attacks are becoming increasingly diverse and sophisticated, evolving from simple typosquatting to complex social engineering attacks as in the xz attack and reputation farming.

    “Also, software supply chain attacks are becoming increasingly diverse and sophisticated, evolving from simple typosquatting [72] to complex social engineering attacks as in the xz attack [11] and reputation farming [18].”
    Quote in the paperNot a substantial claim1 of 3 sources checked
    • cites [72] [72] Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier. 2020. Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment 17th International Conference, DIMVA 2020, Lisbon, Portugal, June 24-26, 2020, Proceedings (Lecture Notes in Computer Science, Vol. 12223) . Springer, 23-43. - source
    • cites [11] [11] 2024. Everything you need to know about the xz util backdoor . Retrieved Sept 18, 2024 from https://www.wired.com/story/xz-backdoor-everything-you-needto-know/ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [18] [18] 2024. OpenSSF Warns of Reputation Farming Leveraging Closed GitHub Issues and PRs . Retrieved Sept 23, 2024 from https://socket.dev/blog/openssf-warnsof-reputation-farming-using-closed-github-issues-and-prs -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Findingcitation
    § 1 Introduction · p. 2

    StarScout can detect 81% of repositories and 76% of accounts in a confirmed malware campaign involving fake stars.

    “StarScout can detect 81% of repositories and 76% of accounts in a confirmed malware campaign involving fake stars [21]”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [21] [21] 2024. Stargazer Ghost Network . Retrieved Sept 17, 2024 from https://research. checkpoint.com/2024/stargazers-ghost-network/ -

      Not checked in the free run.

  • May combine two claims.

    Findingnone given
    § 3.4 Evaluation · p. 5

    The baseline deletion ratio is 5.03% for repositories and 3.54% for users.

    “Compared with the baseline deletion ratio (5.03% for repositories and 3.54% for users)”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § 3.3 Implementation · p. 5

    In the postprocessing step, StarScout identified 18,617 repositories with fake star campaigns and 301k participating accounts, corresponding to 3.81 million fake stars.

    “In the postprocessing step, StarScout identified 18,617 repositories with fake star campaigns and 301k participating accounts (corresponding to 3.81 million fake stars).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § 3.4 Evaluation · p. 5

    StarScout can achieve up to 82.23% recall for repositories and 75.95% recall for accounts when detecting fake-star-powered malware campaigns.

    “StarScout can achieve up to 82.23% recall for repositories and 75.95% recall for accounts when it comes to the detection of fake-starpowered malware campaigns.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § 3.3 Implementation · p. 5

    Among the six million suspected fake stars, 1.06 million were identified with the low activity signature and 4.93 million with the lockstep signature.

    “among these stars, 1.06 million are identified with the low activity signature and 4.93 million with the lockstep signature.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § 3.4 Evaluation · p. 5

    StarScout can detect 688 (81.23%) of the 847 repositories and 11,903 (75.95%) of the 15,672 involved GitHub accounts in the Stargazer Ghost Network dataset.

    “StarScout can detect 688 (81.23%) of the 847 repositories and 11,903 (75.95%) of the 15,672 involved GitHub accounts.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § 4.4 RQ4: Promotional Effect · p. 10

    Fake stars have a statistically significant, longitudinally decreasing positive effect on attracting real stars in the next two months, but the effect is about 5x smaller than that of real stars.

    “In other words, fake stars do have a statistically significant, longitudinally decreasing positive effect on attracting real stars in the next two months, but the effect is about 5x smaller than that of real stars.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § 4.3 RQ3: Repository Characteristics · p. 8

    1,783 non-deleted repositories in total.

    “For the remaining non-deleted repositories (1,783 in total)”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § 4.3 RQ3: Repository Characteristics · p. 8

    The remaining popular categories include AI/LLM, Blockchain, Tool/Applications, and Tutorials/Demos.

    “The remaining popular categories include: (1) AI/LLM , many of which are academic paper repositories or LLMrelated startup products, (2) Blockchain or cryptocurrency related repositories, (3) Tool/Applications , or (4) Tutorials/Demos that seem to serve a reference or demonstration purpose”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § 4.1 RQ1: Prevalence · p. 7

    The most common registries are PyPI (159 packages), npm (145), Pub (138), Cargo (123), and Go (118).

    “the most common registries are: PyPI (159 packages), npm (145), Pub (138), Cargo (123), and Go (118)”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § 5.3 Third-Party Tool Providers · p. 11

    The company's blog post about fake stars had over 2.4k page views, and their tool generated alerts for 283 out of two million distinct customer SBOMs.

    “At the time of writing, the company's blog post about fake stars had over 2.4k page views, and their tool generated alerts for 283 out of two million distinct customer Software Bill of Materials (SBOMs).”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Findingreasoning
    § 4.3 RQ3: Repository Characteristics · p. 8

    299 randomly sampled repositories from remaining 1,476.

    “299 randomly sampled repositories from the remaining 1,476 repositories”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § 4.2 RQ2: Activity Patterns · p. 7

    User accounts with the lockstep signature can be active for long, with distribution similar to average GitHub stargazers.

    “user accounts with the lockstep signature can be active for long, with the overall distribution being similar to average GitHub stargazers”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § 4.4 RQ4: Promotional Effect · p. 10

    A 1% increase in real stars in month t is associated with an expected 0.36% increase in real stars in month t+1, 0.15% in month t+2, and 0.10% for all subsequent months, with the effect always positive.

    “Analogously, one can expect a 0.36% increase of real stars from month 𝑡 to month 𝑡 + 1. The effect decreases to 0.15% in month 𝑡 + 2 and to 0.10% for all subsequent months, but the effect is always positive.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § 5.3 Third-Party Tool Providers · p. 11

    The alert currently only applies to a small percentage of SBOMs in industry software projects, as we only identified 229 repositories with fake star campaigns and also published in package registries.

    “As expected, this alert currently only applies to a small percentage of SBOMs in industry software projects, as we only identified 229 repositories with fake star campaigns and also published in package registries (Section 4.1).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given
    § 5 Discussion: What to Do about Fake Stars? · p. 10

    Fake stars are demonstrably associated with increasing security risks and spam/phishing activities.

    “Most alarmingly, fake stars are demonstrably associated with increasing security risks and spam/phishing activities.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § 4.2 RQ2: Activity Patterns · p. 7

    Repositories and accounts in fake star campaigns tend to be skewed toward starring activities and rarely engage in harder-to-fake activities.

    “repositories and accounts in fake star campaigns tend to be skewed toward starring activities, and they rarely engage in activities that are considerably harder to fake”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given
    § C Inter-Rater Reliability Analysis · p. 15

    At the time of writing, the Figure 9 phishing repository still has more than 50 fake stars remaining and visible in its GitHub repository.

    “At the time of writing, the repository still has more than 50 fake stars remaining and visible in its GitHub repository.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § A GitHub Star Provider Examples · p. 14

    The listed GitHub star merchants often claim to deliver their stars in days or even hours.

    “they often claim to deliver their stars in days or even hours.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingnone given
    § B Definition of Repository Categories · p. 14

    For the Figure 8 phishing repository, almost all of its fake stars have been removed while the repository is still accessible at the time of writing.

    “While the repository is still accessible at the time of writing, almost all of its fake stars have been removed.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § C Inter-Rater Reliability Analysis · p. 15

    In repository Uttampatel1/temp1, the phishing malware link was only added in a later commit six months after creation.

    “The phishing malware link was only added in a later commit six months after creation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § A GitHub Star Provider Examples · p. 14

    The prices of the listed GitHub star merchants range from $0.10 to $2.00 per star.

    “Their prices range from $0.10 to $2.00 per star”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

    Findingown data
    § A GitHub Star Provider Examples · p. 14

    Table 7 shows a non-exhaustive list of GitHub star merchants collected in July 2024 through Google Search.

    “Table 7 shows a non-exhaustive list collected in July 2024 through Google Search.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingcitation
    § C Inter-Rater Reliability Analysis · p. 14

    The Cohen's κ between the human coding results and AI coding results is 0.71, indicating strong agreement.

    “The Cohen's 𝜅 between the human coding results and AI coding results is 0.71, indicating strong agreement [65].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [65] [65] J Richard Landis and Gary G Koch. 1977. The measurement of observer agreement for categorical data. Biometrics (1977), 159-174. - source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § B Definition of Repository Categories · p. 14

    An example phishing repository claiming to be game cheats had 149 fake stars detected by StarScout.

    “An example phishing repository claiming to be game cheats, with 149 fake stars detected by StarScout .”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § C Inter-Rater Reliability Analysis · p. 15

    An example phishing repository claiming to be a cryptocurrency bot had 115 fake stars detected by StarScout.

    “An example phishing repository claiming to be a cryptocurrency bot, with 115 fake stars detected by StarScout .”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § 2.2 Software Supply Chain Attacks · p. 3

    Fake stars can be a useful weapon for both compromising existing open-source components and promoting new malicious software.

    “Fake stars can be a useful weapon for both kinds of attacks: An attacker can either establish a fake reputation and seek maintainership of critical open-source projects or buy fake stars to promote their own phishing repositories.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 2.3 GitHub Stars · p. 3

    Du et al. collected 1,023 black market GitHub accounts through honeypots and built machine learning classifiers to identify 63,872 more suspected GitHub accounts from 2015 to 2019.

    “Du et al. [44] collected 1,023 black market GitHub accounts through honeypots and built machine learning classifiers to identify 63,872 more suspected GitHub accounts from 2015 to 2019.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [44] [44] Kun Du, Hao Yang, Yubao Zhang, Haixin Duan, Haining Wang, Shuang Hao, Zhou Li, and Min Yang. 2020. Understanding Promotion-as-a-Service on GitHub. In ACSAC '20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020 . ACM, 597-610. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation
    § 1 Introduction · p. 2

    GitHub repositories may buy GitHub stars for growth hacking, spamming, résumé fraud, or spreading malware.

    “GitHub repositories may buy GitHub stars for growth hacking [3], spamming [10], résumé fraud [44], or even for spreading malware [21].”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [3] [3] 2021. Controversy arises as Ali OceanBase offers gifts for GitHub stars, CTO apologizes . Retrieved July 9, 2024 from https://mp.weixin.qq.com/s/q62sSpd6y7\_ JGt7mKG0LbQ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10] [10] 2023. Tracking the Fake GitHub Star Black Market with Dagster, dbt and BigQuery. Retrieved July 9, 2024 from https://dagster.io/blog/fake-stars -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [44] [44] Kun Du, Hao Yang, Yubao Zhang, Haixin Duan, Haining Wang, Shuang Hao, Zhou Li, and Min Yang. 2020. Understanding Promotion-as-a-Service on GitHub. In ACSAC '20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020 . ACM, 597-610. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning
    § 1 Introduction · p. 2

    Bought GitHub stars corrupt the GitHub star count as a decision-making signal and pose a security threat to all GitHub users.

    “these bought GitHub stars (hereafter 'fake stars' to match online discussions) corrupt the GitHub star count as a decision-making signal and pose a security threat to all GitHub users”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation
    § 1 Introduction · p. 2

    Most prior reports of fake GitHub stars come from the gray literature and do not go beyond studying a few specific cases.

    “most prior reports of fake GitHub stars come from the gray literature (i.e., non-peer-reviewed blog posts, news reports, and online discussions), and they do not go beyond studying a few specific cases [3, 10, 21, 44].”
    Quote in the paperSubstantial claim0 of 4 sources checked
    • cites [3] [3] 2021. Controversy arises as Ali OceanBase offers gifts for GitHub stars, CTO apologizes . Retrieved July 9, 2024 from https://mp.weixin.qq.com/s/q62sSpd6y7\_ JGt7mKG0LbQ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10] [10] 2023. Tracking the Fake GitHub Star Black Market with Dagster, dbt and BigQuery. Retrieved July 9, 2024 from https://dagster.io/blog/fake-stars -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [21] [21] 2024. Stargazer Ghost Network . Retrieved Sept 17, 2024 from https://research. checkpoint.com/2024/stargazers-ghost-network/ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [44] [44] Kun Du, Hao Yang, Yubao Zhang, Haixin Duan, Haining Wang, Shuang Hao, Zhou Li, and Min Yang. 2020. Understanding Promotion-as-a-Service on GitHub. In ACSAC '20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020 . ACM, 597-610. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning
    § 3.1 Overview · p. 3

    Both the low activity signature and the lockstep signature are hard to avoid for accounts controlled by GitHub star merchants.

    “Both signatures are hard to avoid for accounts controlled by GitHub star merchants: Whatever obfuscation methods they use or however realistic they are, these accounts must be either newly-registered throw-away accounts or have been synchronously starring repositories in short time windows to meet their promised delivery times.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data
    § 3.4 Evaluation · p. 5

    The postprocessing step is effective and necessary.

    “providing support for the effectiveness and necessity of the postprocessing step”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation
    § 1 Introduction · p. 2

    The sheer amount of GitHub data and the rate limit of GitHub APIs present challenges to a global analysis.

    “the sheer amount of GitHub data ( ∼ 20TB of metadata in the past five years [1]) and the rate limit of GitHub APIs [20] present challenges to a global analysis”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [1] [1] 2011. GHArchive . Retrieved Sept 19, 2024 from https://www.gharchive.org/ -

      Not checked in the free run.

    • cites [20] [20] 2024. Rate limits for the REST API . Retrieved Sept 18, 2024 from https://docs. github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api -

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data
    § 3.4 Evaluation · p. 5

    Both signatures may be noisy in identifying individual fake stars but, when combined, effective in identifying repositories with fake star campaigns.

    “both signatures may be noisy in identifying individual fake stars but, when combined, effective in identifying repositories with fake star campaigns”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Study design and conductreasoning
    § 3.1 Overview · p. 3

    Both the low activity signature and the lockstep signature may lead to false positives for repositories and accounts.

    “both signatures may lead to false positives (both to repositories and to accounts), as a legitimate user may happen to behave similarly, or a fake account may star legitimate repositories to hide themselves.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation
    § 2.3 GitHub Stars · p. 3

    The GitHub star black market operates in at least three different ways: selling stars in batches, exchange platforms, and incentivizing starring with gifts.

    “the GitHub star black market operates in at least three different ways: (1) Merchants can sell GitHub stars in batches of (usually) 50 or 100 stars on their own websites (examples in Appendix, Section 6), instant messaging apps [44], or in e-commerce platforms such as Taobao [4]; (2) GitHub users may form exchange platforms (e.g., GitStar [14] or instant messaging groups), where they incentivize”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [44] [44] Kun Du, Hao Yang, Yubao Zhang, Haixin Duan, Haining Wang, Shuang Hao, Zhou Li, and Min Yang. 2020. Understanding Promotion-as-a-Service on GitHub. In ACSAC '20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020 . ACM, 597-610. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [4] [4] 2022. GitHub 'Patriotic Package,' Actually Just Selling Stars . Retrieved Sept 24, 2024 from https://juejin.cn/post/7115303814483148807 -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [14] [14] 2024. GitStar . Retrieved Sept 24, 2024 from https://gitstar.com.cn/ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given
    § 3.4 Evaluation · p. 5

    Precision is inherently harder to evaluate because there is no obvious way to examine whether a star is fake or not.

    “Precision is inherently harder to evaluate because there is no obvious way to examine whether a star is fake or not.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § 1 Introduction · p. 2

    GitHub stars can be faked in various ways, including bots, crowdsourced humans, and exchange platforms.

    “GitHub stars can be faked in various ways (e.g., bots [21], crowdsourced humans [3], exchange platforms where users exchange stars for a reward [44])”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [21] [21] 2024. Stargazer Ghost Network . Retrieved Sept 17, 2024 from https://research. checkpoint.com/2024/stargazers-ghost-network/ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [3] [3] 2021. Controversy arises as Ali OceanBase offers gifts for GitHub stars, CTO apologizes . Retrieved July 9, 2024 from https://mp.weixin.qq.com/s/q62sSpd6y7\_ JGt7mKG0LbQ -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [44] [44] Kun Du, Hao Yang, Yubao Zhang, Haixin Duan, Haining Wang, Shuang Hao, Zhou Li, and Min Yang. 2020. Understanding Promotion-as-a-Service on GitHub. In ACSAC '20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020 . ACM, 597-610. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation
    § 3.2 Heuristics and Postprocessing · p. 4

    The lockstep signature is unlikely to form naturally and is highly correlated to fraudulent activities.

    “this signature is unlikely to form naturally and highly correlated to fraudulent activities [30, 57, 73]”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [30] [30] Alex Beutel, Wanhong Xu, Venkatesan Guruswami, Christopher Palow, and Christos Faloutsos. 2013. CopyCatch: Stopping group attacks by spotting lockstep behavior in social networks. In 22nd International World Wide Web Conference, WWW '13, Rio de Janeiro, Brazil, May 13-17, 2013 . ACM, 119-130. - source
    • cites [57] [57] Bryan Hooi, Hyun Ah Song, Alex Beutel, Neil Shah, Kijung Shin, and Christos Faloutsos. 2016. FRAUDAR: Bounding Graph Fraud in the Face of Camouflage. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . ACM, 895-904. - source
    • cites [73] [73] Shashank Pandit, Duen Horng Chau, Samuel Wang, and Christos Faloutsos. 2007. Netprobe: A fast and scalable system for fraud detection in online auction networks. In Proceedings of the 16th International Conference on World Wide Web, WWW2007, Banff, Alberta, Canada, May 8-12, 2007 . ACM, 201-210. - source

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning
    § 2.3 GitHub Stars · p. 3

    Despite the limited reliability of GitHub stars, the lack of obvious alternatives makes it still an important signal in decision-making processes.

    “Despite studies arguing the limited reliability of GitHub stars, the lack of obvious alternatives makes it still an important signal in these decision-making processes.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation
    § 3.2 Heuristics and Postprocessing · p. 4

    CopyCatch is highly scalable and has been shown to work reasonably well in practice.

    “it is highly scalable and has been shown to work reasonably well in practice [30]”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [30] [30] Alex Beutel, Wanhong Xu, Venkatesan Guruswami, Christopher Palow, and Christos Faloutsos. 2013. CopyCatch: Stopping group attacks by spotting lockstep behavior in social networks. In 22nd International World Wide Web Conference, WWW '13, Rio de Janeiro, Brazil, May 13-17, 2013 . ACM, 119-130. - source

  • Probably not a substantial claim: may not pass S1 (asserted). May combine two claims.

    Premisecitation
    § 3.4 Evaluation · p. 5

    GitHub actively counters fraudulent and malicious activities, so a higher deletion rate should be observed in the StarScout sample compared to the baseline.

    “We choose this criterion based on reports of GitHub actively countering fraudulent and malicious activities [13]-thus, we should be able to observe a higher deletion rate in the StarScout sample compared to the baseline”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [13] [13] 2024. The GitHub Black Market That Helps Coders Cheat the Popularity Contest . Retrieved July 9, 2024 from https://www.wired.com/story/github-stars-blackmarket-coders-cheat/ -

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning
    § 3.5 Limitations and Ethical Concerns · p. 5

    Some StarScout identified repositories and accounts may be false positives.

    “it is possible that some of the StarScout identified repositories and accounts may still be false positives”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning
    § 3.2 Heuristics and Postprocessing · p. 4

    The low activity signature may also identify real users wrongly, for example someone who legitimately registered an account, starred a repository, and then gave up using GitHub.

    “they may also be real users wrongly identified (e.g., someone legitimately registered an account, starred a repository, and then gave up using GitHub)”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 2.1 Fraudulent Activities in Social Networks · p. 2

    Supervised machine learning models can detect fraudulent activities with high accuracy given a ground truth dataset and reasonable feature engineering.

    “With a ground truth dataset and reasonable feature engineering, it is often possible to build high accuracy supervised machine learning models to detect such activities”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [83] [83] Jonghyuk Song, Sangho Lee, and Jong Kim. 2015. CrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, October 12-16, 2015 . ACM, 793-804. - source
    • cites [84] [84] Gianluca Stringhini, Gang Wang, Manuel Egele, Christopher Kruegel, Giovanni Vigna, Haitao Zheng, and Ben Y. Zhao. 2013. Follow the green: Growth and dynamics in Twitter follower markets. In Proceedings of the 2013 Internet Measurement Conference, IMC 2013 . ACM, 163-176. - source
    • cites [98] [98] Cao Xiao, David Mandell Freeman, and Theodore Hwa. 2015. Detecting Clusters of Fake Accounts in Online Social Networks. In Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security, AISec 2015 . ACM, 91-101. - source

  • May combine two claims.

    Premisecitation
    § 3.4 Evaluation · p. 5

    Using honeypots to evaluate a fake activity detector raises ethical concerns because it would fund malicious actors and create spam for other developers.

    “they raise ethical concerns [62, 94]: If we were to buy fake stars for a honeypot repository, we would be effectively funding malicious actors and creating spam for other developers.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [62] [62] Tadayoshi Kohno, Yasemin Acar, and Wulf Loh. 2023. Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023 . USENIX Association, 5145-5162. - source
    • cites [94] [94] Edgar R. Weippl, Sebastian Schrittwieser, and Sylvi Rennert. 2016. Empirical Research and Research Ethics in Information Security. In Information Systems Security and Privacy - Second International Conference, ICISSP 2016, Rome, Italy, February 19-21, 2016, Revised Selected Papers (Communications in Computer and Information Science, Vol. 691) . Springer, 14-22. - source

  • May combine two claims.

    Interpretationreasoning
    § 3.2 Heuristics and Postprocessing · p. 4

    Repositories with an anomalous spike of fake stars that contributes a non-negligible portion of stars have probably run a fake star campaign and are probably not a victim of fake stargazers.

    “We infer that these repositories have probably run a fake star campaign and are probably not a victim of fake stargazers, as they gained a noticeable benefit from those stars.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning
    § 2.3 GitHub Stars · p. 3

    Repositories with fake stars may gain an unfair advantage in the GitHub popularity contest, which can be exploited to harm stakeholders in the software supply chain.

    “Repositories with fake stars may gain an unfair advantage in the GitHub popularity contest, which can be then exploited in various ways to harm stakeholders in the software supply chain.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationown data
    § 3.2 Heuristics and Postprocessing · p. 4

    It is unreasonable to expect that every repository receiving fake stars is actively seeking fake stars.

    “it is unreasonable to expect that every repository receiving fake stars is actively seeking fake stars”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 3.2 Heuristics and Postprocessing · p. 4

    CopyCatch is a state-of-the-art algorithm that has been deployed at Facebook to detect fake Likes with the same lockstep signatures.

    “StarScout implements CopyCatch [30], a state-of-the-art algorithm that has been deployed at Facebook to detect fake Likes with the same lockstep signatures.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [30] [30] Alex Beutel, Wanhong Xu, Venkatesan Guruswami, Christopher Palow, and Christos Faloutsos. 2013. CopyCatch: Stopping group attacks by spotting lockstep behavior in social networks. In 22nd International World Wide Web Conference, WWW '13, Rio de Janeiro, Brazil, May 13-17, 2013 . ACM, 119-130. - source

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning
    § 5.2 Platform Providers · p. 10

    Our study provides an example of how platform transparency enables large-scale independent studies of fraud and malicious activities.

    “Finally, our study provides an example of how platform transparency enables large-scale independent studies of fraud and malicious activities .”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data
    § 4.4 RQ4: Promotional Effect · p. 10

    Buying fake stars may help a repository gain real attention in the short term (less than two months), but the effect is about 5x smaller than real stars; in the long term, buying fake stars has a negative effect on star gain.

    “This suggests that buying fake stars may only help the repository gain new attention in the short term (i.e., less than two months), but the history of faking stars becomes a liability and may result in less overall attention in the long term, perhaps because the repository lacks in other activity and health indicators.”
    • Also stated in: § 4.4 RQ4: Promotional Effect · p. 10 · hedged
      “Finding 8: Buying fake stars may help a repository gain real attention in the short term (i.e., less than two months), but the effect is about 5x smaller compared to real stars; in the long term, buying fake stars has a negative effect on star gain.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationown data
    § 5.1 Open-Source Practitioners · p. 10

    There is no plausible mechanism to convert stars into real, sustained adoption, even if a high star count may increase project visibility in the short term.

    “Our interpretation is that there is no plausible mechanism to convert stars into real, sustained adoption, even if a high star count may increase project visibility in the short term.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductnone given
    § 4.3 RQ3: Repository Characteristics · p. 8

    Sample size determined from 95% confidence level and 5% margin of error.

    “(sample size determined from 95% confidence level and 5% margin of error)”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Study design and conductnone given
    § 4.4 RQ4: Promotional Effect · p. 9

    Unobserved heterogeneity in fixed effect models is controlled by per-time and per-repository fixed-effect terms.

    “unobserved heterogeneity in fixed effect models is controlled by the per-time and per-repository fixed-effect terms”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data
    § 5.3 Third-Party Tool Providers · p. 11

    The fact that these packages are found in actual customer SBOMs underscores the practical relevance of our research findings and signals the potential for mitigation through third-party tools.

    “Yet, the fact that these packages are found in actual customer SBOMs underscores the practical relevance of our research findings and signals the potential for mitigation through third-party tools.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning
    § 5.2 Platform Providers · p. 10

    We could not have conducted this study without GitHub's high level of openness.

    “We could not have conducted this study without GitHub's high level of openness, which unfortunately, is not common in many other online platforms.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § 5.1 Open-Source Practitioners · p. 10

    Stars may not only misrepresent popularity or reputation, but can be intentionally manipulated by malicious actors.

    “We provide further evidence that stars may not only misrepresent popularity or reputation, but can be intentionally manipulated by malicious actors.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning
    § C Inter-Rater Reliability Analysis · p. 15

    The LLM's coding results were used to correct human coding errors before aggregating and reporting the open coding results in RQ3.

    “We use the LLM's coding results to correct human coding errors before we aggregate and report the open coding results in RQ3.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The LLM's coding results can correct human coding errors in the open-coding process.

  • May combine two claims.

    Interpretationreasoning
    § D Spam/Phishing Repository Examples · p. 15

    The two repositories in Figure 8 and Figure 9 have different levels of fake star retention, indicating that GitHub is actively taking action to counter fake stars.

    “Note that the two repositories have different level of fake star retention, indicating that GitHub is actively taking action to counter fake stars.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Differences in fake star retention between repositories are caused by GitHub moderation actions.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § E Additional Regression Results · p. 15

    Models with higher R2 and lower AIC/BIC are preferred.

    “While in general, models with higher 𝑅 2 and lower AIC/BIC [63] are preferred”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [63] [63] Jouni Kuha. 2004. AIC and BIC: Comparisons of assumptions and performance. Sociological Methods & Research 33, 2 (2004), 188-229. - source

  • Probably not a substantial claim: may not pass S4 (based).

    Study design and conductnone given
    § Responsible Disclosure · p. 11

    StarScout may generate false positives.

    “given the possibility that StarScout may generate false positives and thus false accusations”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § 6 Conclusion · p. 11

    Short-term promotional use of fake stars does not bring long-term returns.

    “used as a short-term promotional tool, which does not bring long-term returns”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data
    § 6 Conclusion · p. 11

    Fake stars are widely prevalent and rising in popularity on GitHub.

    “Despite its wide prevalence and rising popularity, our findings have also revealed its shady nature”
    • Also stated in: § 6 Conclusion · p. 11 · plain
      “Our study sheds light on this prevalent and escalating threat happening in a platform central to modern open-source software development.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § E Additional Regression Results · p. 15

    Results from the fixed-effects model are preferable.

    “so results from the fixed-effects model are preferable.”
    Quote in the paperNot a substantial claim
71 of 71

  • The paper relies on this without support.

    GitHub does not preserve deleted repositories and users.

    “GitHub does not preserve deleted repositories and users, posing difficulties in the measurement of fraudulent or malicious activities, as some of them may have already been taken down by the platform.”

  • The paper relies on this without support.

    Repository names are indicative of repository content.

    “most of the deleted repositories carry names indicating pirated software (e.g., Adobe-Animate-Crack ), cryptocurrency bots (e.g., pixel-wallet-bot-free , Solana-Sniper-Bot ), or game cheats (e.g., GTA5-cheat )”
    “we can still glean some information from a term frequency analysis of their repository names”

  • The paper relies on this without support.

    GitHub's current star system gives equal weight to all stars.

    “The current system, which gives equal weight to all stars, is prone to manipulation from bots and coordinated inauthentic activities.”

  • The paper relies on this without support.

    Differences in fake star retention between repositories are caused by GitHub moderation actions.

    “indicating that GitHub is actively taking action to counter fake stars”

  • The paper relies on this without support.

    The LLM's coding results can correct human coding errors in the open-coding process.

    “We use the LLM's coding results to correct human coding errors before we aggregate and report the open coding results in RQ3.”

  • The paper relies on this without support.

    The delayed addition of the phishing malware link in repository Uttampatel1/temp1 indicates intentional evasion of platform moderation.

    “the phishing malware link was only added in a later commit six months after creation”
6 of 6

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Appendix claim of uniformly negative coefficients has an exception

    Minor

    The appendix says the cumulative fake-star coefficient is negative in all ten additional models, but Table 9 gives it as positive 0.011 in the AR(1) random-effects model.

1 of 1

Cites

Flagged first, then by citations

Research works printed but not linked: 21

  1. 2011. GHArchive. Retrieved Sept 19, 2024 from https://www.gharchive.org/
  2. 2021. Controversy arises as Ali OceanBase offers gifts for GitHub stars, CTO apologizes. Retrieved July 9, 2024 from https://mp.weixin.qq.com/s/q62sSpd6y7_JGt7mKG0LbQ
  3. 2022. Phishing Campaign Targets PyPI Users to Distribute Malicious Code. Retrieved Nov 14, 2024 from https://www.darkreading.com/cloud-security/phishing-campaign-targets-pypi-users-to-distribute-malicious-code
  4. 2023. Malicious Microsoft VSCode extensions steal passwords, open remote shells. Retrieved Sep 23, 2024 from https://www.bleepingcomputer.com/news/security/malicious-microsoft-vscode-extensions-steal-passwords-open-remote-shells/
  5. 2023. Should startups worry about GitHub stars?Retrieved July 9, 2024 from https://technical.ly/software-development/should-startups-worry-about-github-stars/
  6. 2024. GitStar. Retrieved Sept 24, 2024 from https://gitstar.com.cn/
  7. 2024. Millions of Malicious Containers Found on Docker Hub. Retrieved Nov 14, 2024 from https://www.infosecurity-magazine.com/news/malicious-containers-found-docker/
  8. 2024. Open Source Supply, Demand, and Security. Retrieved Sept 18, 2024 from https://www.sonatype.com/state-of-the-software-supply-chain/open-source-supply-and-demand
  9. 2024. Stargazer Ghost Network. Retrieved Sept 17, 2024 from https://research.checkpoint.com/2024/stargazers-ghost-network/
  10. 2024. VirusTotal. Retrieved Nov 8, 2024 from https://www.virustotal.com/
  11. 2025. ecosyste.ms. Retrieved Feb 25, 2025 from https://ecosyste.ms/
  12. David Arthur and Sergei Vassilvitskii. 2007. k-means++: The advantages of careful seeding. In Proceedings of the Eighteenth Annual ACM-SIAM Symposium on Discrete Algorithms, SODA 2007. SIAM, 1027–1035.
  13. Ronald Jay Cohen, Mark E Swerdlik, and Suzanne M Phillips. 1996. Psychological Testing and Assessment: An Introduction to Tests and Measurement. Mayfield Publishing Co.
  14. Chrysanthos Dellarocas. 2010. Online reputation systems: How to design one that does what you need. MIT Sloan Management Review 51 3 (2010) 33.
  15. Nadia Eghbal. 2016. Roads and Bridges: The Unseen Labor Behind Our Digital Infrastructure. Ford Foundation.
  16. Christoph Hanck, Martin Arnold, Alexander Gerber, and Martin Schmelzer. 2021. Regression with Panel Data. In Introduction to Econometrics with R. Universität Duisburg-Essen. https://www.econometrics-with-r.org/10-rwpd.html
  17. Amy Jo Kim. 2006. Community Building on the Web: Secret Strategies for Successful Online Communities. Peachpit Press.
  18. Arjun Mukherjee, Vivek Venkataraman, Bing Liu, and Natalie Glance. 2013. What Yelp fake review filter might be doing?. In Proceedings of the International AAAI Conference on Web and Social Media , Vol. 7. 409–418.
  19. Bimal Viswanath, Muhammad Ahmad Bashir, Mark Crovella, Saikat Guha, Krishna P. Gummadi, Balachander Krishnamurthy, and Alan Mislove. 2014. Towards Detecting Anomalous User Behavior in Online Social Networks. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014. USENIX Association, 223–238.
  20. Gang Wang, Tianyi Wang, Haitao Zheng, and Ben Y. Zhao. 2014. Man vs. Machine: Practical Adversarial Detection of Malicious Crowdsourcing Workers. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014. USENIX Association, 239–254.
  21. Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small World with High Risks: A Study of Security Threats in the npm Ecosystem. In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019. USENIX Association, 995–1010.

Cited by

Sorted by citations

Authors
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C.
Affiliations
  • Carnegie Mellon University (US)
  • Socket Inc, Pittsburgh, PA, USA
  • North Carolina State University (US)
ORCID
Venue
Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering
Publisher
ACM
Published
2026-04-12
Pages
1469-1481
DOI
10.1145/3744916.3764531
OpenAlex
W7212252056
Semantic Scholar
ab9f76461e864cb56adb0d98bd374ba818518cc9
Cited by
2
References
55
Citations by year
2026: 2
FWCI
26.38
Type
conference paper
Language
en
Open access
Licence
Locations
  • IEEE/ACM International Conference on Software Engineering (ICSE) (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Funders
National Science Foundation (2206859, 2207008, 2317168)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Computer Science Applications › Open Source Software Innovations
Keywords
GitHub, popularity metrics, anomaly detection, open source software, growth hacking, supply chain security, platform moderation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review