PreprintCited by 4Spam and Phishing DetectionSoftware Engineering ResearchOpen Source Software Innovations

The DOI matches its DataCite record; 2 of the 2 references it cites were found in a registry or an index.

Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware

Open access

Preprint — published as 10.1145/3744916.3764531 · Paper page

Abstract

GitHub, the de facto platform for open-source software development, provides a set of social-media-like features to signal high-quality repositories. Among them, the star count is the most widely used popularity signal, but it is also at risk of being artificially inflated (i.e., faked), decreasing its value as a decision-making signal and posing a security risk to all GitHub users. In this paper, we present a systematic, global, and longitudinal measurement study of fake stars in GitHub. To this end, we build StarScout, a scalable tool able to detect anomalous starring behaviors across all GitHub metadata between 2019 and 2024. Analyzing the data collected using StarScout, we find that: (1) fake-star-related activities have rapidly surged in 2024; (2) the accounts and repositories in fake star campaigns have highly trivial activity patterns; (3) the majority of fake stars are used to promote short-lived phishing malware repositories; the remaining ones are mostly used to promote AI/LLM, blockchain, tool/application, and tutorial/demo repositories; (4) while repositories may have acquired fake stars for growth hacking, fake stars only have a promotion effect in the short term (i.e., less than two months) and become a liability in the long term. Our study has implications for platform moderators, open-source practitioners, and supply chain security researchers.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2412.13459

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 69

  1. [26][26] Malak Saleh Aljabri, Rachid Zagrouba, Afrah Shaahid, Fatima Alnasser, Asalah Saleh, and Dorieh M. Alomari. 2023. Machine learning-based social media bot detection: A comprehensive literature review. Soc. Netw. Anal. Min. 13, 1 (2023), 20. -
  2. [27][27] Shahram Amini, Michael S Delgado, Daniel J Henderson, and Christopher F Parmeter. 2012. Fixed vs random: The Hausman test four decades later. In Essays in Honor of Jerry Hausman . Vol. 29. Emerald Group Publishing Limited, 479-513. -
  3. [28][28] David Arthur and Sergei Vassilvitskii. 2007. k-means++: The advantages of careful seeding. In Proceedings of the Eighteenth Annual ACM-SIAM Symposium on Discrete Algorithms, SODA 2007 . SIAM, 1027-1035. -
  4. [29][29] Andrew Begel, Jan Bosch, and Margaret-Anne D. Storey. 2013. Social Networking Meets Software Development: Perspectives from GitHub, MSDN, Stack Exchange, and TopCoder. IEEE Softw. 30, 1 (2013), 52-66. -
  5. [30][30] Alex Beutel, Wanhong Xu, Venkatesan Guruswami, Christopher Palow, and Christos Faloutsos. 2013. CopyCatch: Stopping group attacks by spotting lockstep behavior in social networks. In 22nd International World Wide Web Conference, WWW '13, Rio de Janeiro, Brazil, May 13-17, 2013 . ACM, 119-130. -
  6. [31][31] Enrico Blanzieri and Anton Bryl. 2008. A survey of learning-based techniques of email spam filtering. Artif. Intell. Rev. 29, 1 (2008), 63-92. -
  7. [32][32] René Bohnsack and Meike Malena Liesner. 2019. What the hack? A growth hacking taxonomy and practical applications for firms. Business Horizons 62, 6 (2019), 799-818. -
  8. [33][33] Hudson Borges and Marco Túlio Valente. 2018. What's in a GitHub Star? Understanding Repository Starring Practices in a Social Coding Platform. J. Syst. Softw. 146 (2018), 112-129. -
  9. [34][34] Donald T Campbell. 1979. Assessing the impact of planned social change. Evaluation and Program Planning 2, 1 (1979), 67-90. -
  10. [35][35] Alan Cao and Brendan Dolan-Gavitt. 2022. What the fork? Finding and analyzing malware in GitHub forks. In Proc. of NDSS , Vol. 22. -
  11. [36][36] Qiang Cao, Xiaowei Yang, Jieqi Yu, and Christopher Palow. 2014. Uncovering Large Groups of Active Malicious Accounts in Online Social Networks. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA, November 3-7, 2014 . ACM, 477-488. -
  12. [37][37] David Nevado Catalán, Sergio Pastrana, Narseo Vallina-Rodriguez, and Juan Tapiador. 2023. An analysis of fake social media engagement services. Comput. Secur. 124 (2023), 103013. -
  13. [39][39] Stefano Cresci, Roberto Di Pietro, Marinella Petrocchi, Angelo Spognardi, and Maurizio Tesconi. 2015. Fame for sale: Efficient detection of fake Twitter followers. Decis. Support Syst. 80 (2015), 56-71. -
  14. [40][40] Stefano Cresci, Roberto Di Pietro, Marinella Petrocchi, Angelo Spognardi, and Maurizio Tesconi. 2017. The Paradigm-Shift of Social Spambots: Evidence, Theories, and Tools for the Arms Race. In Proceedings of the 26th International Conference on World Wide Web Companion . ACM, 963-972. -
  15. [41][41] Emiliano De Cristofaro, Arik Friedman, Guillaume Jourjon, Mohamed Ali Kâafar, and Muhammad Zubair Shafiq. 2014. Paying for Likes?: Understanding Facebook Like Fraud Using Honeypots. In Proceedings of the 2014 Internet Measurement Conference, IMC 2014 . ACM, 129-136. -
  16. [42][42] Alexandre Decan, Tom Mens, and Philippe Grosjean. 2019. An empirical comparison of dependency network evolution in seven software packaging ecosystems. Empir. Softw. Eng. 24, 1 (2019), 381-416. -
  17. [43][43] Chrysanthos Dellarocas. 2010. Online reputation systems: How to design one that does what you need. MIT Sloan Management Review 51, 3 (2010), 33. -
  18. [44][44] Kun Du, Hao Yang, Yubao Zhang, Haixin Duan, Haining Wang, Shuang Hao, Zhou Li, and Min Yang. 2020. Understanding Promotion-as-a-Service on GitHub. In ACSAC '20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020 . ACM, 597-610. -
  19. [45][45] Elena-Ivona Dumitrescu and Christophe Hurlin. 2012. Testing for Granger noncausality in heterogeneous panels. Economic Modelling 29, 4 (2012), 1450-1460. -
  20. [47][47] Robert F Engle, David F Hendry, and Jean-Francois Richard. 1983. Exogeneity. Econometrica: Journal of the Econometric Society (1983), 277-304. -
  21. [48][48] Hongbo Fang, Daniel Klug, Hemank Lamba, James D. Herbsleb, and Bogdan Vasilescu. 2020. Need for Tweet: How Open Source Developers Talk About Their GitHub Work on Twitter. In MSR '20: 17th International Conference on Mining Software Repositories . ACM, 322-326. -
  22. [49][49] Hongbo Fang, Hemank Lamba, James D. Herbsleb, and Bogdan Vasilescu. 2022. "This Is Damn Slick!" Estimating the Impact of Tweets on Open Source Project Popularity and New Contributors. In 44th IEEE/ACM 44th International Conference on Software Engineering, ICSE 2022 . ACM, 2116-2129. -
  23. [51][51] Chris Grier, Kurt Thomas, Vern Paxson, and Chao Michael Zhang. 2010. @spam: The underground on 140 characters or less. In Proceedings of the 17th ACM Conference on Computer and Communications Security, CCS 2010 . ACM, 27-37. -
  24. [52][52] Nick Hagar and Aaron Shaw. 2022. Concentration without cumulative advantage: The distribution of news source attention in online communities. Journal of Communication 72, 6 (2022), 675-686. -
  25. [54][54] Hao He, Haoqin Yang, Philipp Burckhardt, Alexandros Kapravelos, Bogdan Vasilescu, and Christian Kästner. 2024. Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware. CoRR abs/2412.13459 (2024). arXiv:2412.13459 -
  26. [55][55] Li He, Xianzhi Wang, Hongxu Chen, and Guandong Xu. 2022. Online Spam Review Detection: A Survey of Literature. Hum. Centric Intell. Syst. 2, 1-2 (2022), 14-30. -
  27. [57][57] Bryan Hooi, Hyun Ah Song, Alex Beutel, Neil Shah, Kijung Shin, and Christos Faloutsos. 2016. FRAUDAR: Bounding Graph Fraud in the Face of Camouflage. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . ACM, 895-904. -
  28. [58][58] Muhammad Ikram, Lucky Onwuzurike, Shehroze Farooqi, Emiliano De Cristofaro, Arik Friedman, Guillaume Jourjon, Mohamed Ali Kâafar, and M. Zubair Shafiq. 2017. Measuring, Characterizing, and Detecting Facebook Like Farms. ACM Trans. Priv. Secur. 20, 4 (2017), 13:1-13:28. -
  29. [60][60] AmyJoKim.2006. CommunityBuilding on the Web: Secret Strategies for Successful Online Communities . Peachpit Press. -
  30. [61][61] Simon Koch, David Klein, and Martin Johns. 2024. The Fault in Our Stars: An Analysis of GitHub Stars as an Importance Metric for Web Source Code. In MADWeb: Workshop on Measurements; Attacks and Defenses for the Web . -
  31. [62][62] Tadayoshi Kohno, Yasemin Acar, and Wulf Loh. 2023. Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023 . USENIX Association, 5145-5162. -
  32. [63][63] Jouni Kuha. 2004. AIC and BIC: Comparisons of assumptions and performance. Sociological Methods & Research 33, 2 (2004), 188-229. -
  33. [64][64] Piergiorgio Ladisa, Henrik Plate, Matias Martinez, and Olivier Barais. 2023. SoK: Taxonomy of Attacks on Open-Source Software Supply Chains. In 44th IEEE Symposium on Security and Privacy, SP 2023 . IEEE, 1509-1526. -
  34. [66][66] Majd Latah. 2020. Detection of malicious social bots: A survey and a refined taxonomy. Expert Syst. Appl. 151 (2020), 113383. -
  35. [67][67] Yuxing Ma, Tapajit Dey, Chris Bogart, Sadika Amreen, Marat Valiev, Adam Tutko, David Kennard, Russell Zaretzki, and Audris Mockus. 2021. World of Code: Enabling a research workflow for mining and analyzing the universe of open source VCS data. Empir. Softw. Eng. 26, 2 (2021), 22. -
  36. [68][68] Dana Movshovitz-Attias, Yair Movshovitz-Attias, Peter Steenkiste, and Christos Faloutsos. 2013. Analysis of the reputation system and user contributions on a question answering website: StackOverflow. In Advances in Social Networks Analysis and Mining 2013, ASONAM '13 . ACM, 886-893. -
  37. [69][69] Suhaib Mujahid, Rabe Abdalkareem, and Emad Shihab. 2023. What are the characteristics of highly-selected packages? A case study on the npm ecosystem. J. Syst. Softw. 198 (2023), 111588. -
  38. [70][70] Arjun Mukherjee, Vivek Venkataraman, Bing Liu, and Natalie Glance. 2013. What Yelp fake review filter might be doing?. In Proceedings of the International AAAI Conference on Web and Social Media , Vol. 7. 409-418. -
  39. [71][71] Nuthan Munaiah, Steven Kroh, Craig Cabrey, and Meiyappan Nagappan. 2017. Curating GitHub for engineered software projects. Empir. Softw. Eng. 22, 6 (2017), 3219-3253. -
  40. [72][72] Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier. 2020. Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment 17th International Conference, DIMVA 2020, Lisbon, Portugal, June 24-26, 2020, Proceedings (Lecture Notes in Computer Science, Vol. 12223) . Springer, 23-43. -
  41. [73][73] Shashank Pandit, Duen Horng Chau, Samuel Wang, and Christos Faloutsos. 2007. Netprobe: A fast and scalable system for fraud detection in online auction networks. In Proceedings of the 16th International Conference on World Wide Web, WWW2007, Banff, Alberta, Canada, May 8-12, 2007 . ACM, 201-210. -
  42. [74][74] René Peeters. 2003. The maximum edge biclique problem is NP-complete. Discret. Appl. Math. 131, 3 (2003), 651-654. -
  43. [75][75] Francesco Pierri, Alessandro Artoni, and Stefano Ceri. 2020. Investigating Italian disinformation spreading on Twitter in the context of 2019 European elections. PloS One 15, 1 (2020), e0227821. -
  44. [76][76] Huilian Sophie Qiu, Yucen Lily Li, Hema Susmita Padala, Anita Sarma, and Bogdan Vasilescu. 2019. The Signals that Potential Contributors Look for When Choosing Open-source Projects. Proc. ACM Hum. Comput. Interact. 3, CSCW (2019), 122:1-122:29. -
  45. [77][77] Sanjeev Rao, Anil Kumar Verma, and Tarunpreet Bhatia. 2021. A review on social spam detection: Challenges, open issues, and future directions. Expert Syst. Appl. 186 (2021), 115742. -
  46. [79][79] Peter J Rousseeuw. 1987. Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. J. Comput. Appl. Math. 20 (1987), 53-65. -
  47. [80][80] William Schueller and Johannes Wachs. 2024. Modeling interconnected social and technical risks in open source software ecosystems. Collective Intelligence 3, 1 (2024), 26339137241231912. -
  48. [81][81] Indira Sen, Anupama Aggarwal, Shiven Mian, Siddharth Singh, Ponnurangam Kumaraguru, and Anwitaman Datta. 2018. Worth its Weight in Likes: Towards Detecting Fake Likes on Instagram. In Proceedings of the 10th ACM Conference on Web Science, WebSci 2018 . ACM, 205-209. -
  49. [82][82] Chengcheng Shao, Giovanni Luca Ciampaglia, Onur Varol, Kai-Cheng Yang, Alessandro Flammini, and Filippo Menczer. 2018. The spread of low-credibility content by social bots. Nature Communications 9, 1 (2018), 1-9. -
  50. [83][83] Jonghyuk Song, Sangho Lee, and Jong Kim. 2015. CrowdTarget: Target-based Detection of Crowdturfing in Online Social Networks. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, October 12-16, 2015 . ACM, 793-804. -
  51. [84][84] Gianluca Stringhini, Gang Wang, Manuel Egele, Christopher Kruegel, Giovanni Vigna, Haitao Zheng, and Ben Y. Zhao. 2013. Follow the green: Growth and dynamics in Twitter follower markets. In Proceedings of the 2013 Internet Measurement Conference, IMC 2013 . ACM, 163-176. -
  52. [85][85] Nishat Ara Tania, Md Rayhanul Masud, Md Omar Faruk Rokon, Qian Zhang, and Michalis Faloutsos. 2024. Who is Creating Malware Repositories on GitHub and Why?. In Companion Proceedings of the ACM on Web Conference 2024, WWW 2024, Singapore, Singapore, May 13-17, 2024 . ACM, 955-958. -
  53. [86][86] Kurt Thomas, Chris Grier, Dawn Song, and Vern Paxson. 2011. Suspended accounts in retrospect: An analysis of Twitter spam. In Proceedings of the 11th ACM SIGCOMM Internet Measurement Conference, IMC '11, Berlin, Germany, November 2-, 2011 . ACM, 243-258. -
  54. [87][87] Asher Trockman, Shurui Zhou, Christian Kästner, and Bogdan Vasilescu. 2018. Adding sparkle to social coding: An empirical study of repository badges in the npm ecosystem. In Proceedings of the 40th International Conference on Software Engineering, ICSE 2018 . ACM, 511-522. -
  55. [88][88] Jason Tsay, Laura Dabbish, and James D. Herbsleb. 2014. Influence of social and technical factors for evaluating contribution in GitHub. In 36th International Conference on Software Engineering, ICSE '14 . ACM, 356-366. -
  56. [89][89] Enrique Larios Vargas, Maurício Finavaro Aniche, Christoph Treude, Magiel Bruntink, and Georgios Gousios. 2020. Selecting third-party libraries: The practitioners' perspective. In ESEC/FSE '20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Virtual Event, USA, November 8-13, 2020 . ACM, 245-256. -
  57. [90][90] Bimal Viswanath, Muhammad Ahmad Bashir, Mark Crovella, Saikat Guha, Krishna P. Gummadi, Balachander Krishnamurthy, and Alan Mislove. 2014. Towards Detecting Anomalous User Behavior in Online Social Networks. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014 . USENIX Association, 223-238. -
  58. [91][91] Duc-Ly Vu, Ivan Pashchenko, Fabio Massacci, Henrik Plate, and Antonino Sabetta. 2020. Typosquatting and Combosquatting Attacks on the Python Ecosystem. In IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2020, Genoa, Italy, September 7-11, 2020 . IEEE, 509-514. -
  59. [92][92] Gang Wang, Tianyi Wang, Haitao Zheng, and Ben Y. Zhao. 2014. Man vs. Machine: Practical Adversarial Detection of Malicious Crowdsourcing Workers. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 20-22, 2014 . USENIX Association, 239-254. -
  60. [93][93] Gang Wang, Christo Wilson, Xiaohan Zhao, Yibo Zhu, Manish Mohanlal, Haitao Zheng, and Ben Y. Zhao. 2012. Serf and turf: Crowdturfing for fun and profit. In Proceedings of the 21st World Wide Web Conference 2012, WWW 2012, Lyon, France, April 16-20, 2012 . ACM, 679-688. -
  61. [94][94] Edgar R. Weippl, Sebastian Schrittwieser, and Sylvi Rennert. 2016. Empirical Research and Research Ethics in Information Security. In Information Systems Security and Privacy - Second International Conference, ICISSP 2016, Rome, Italy, February 19-21, 2016, Revised Selected Papers (Communications in Computer and Information Science, Vol. 691) . Springer, 14-22. -
  62. [95][95] Dominik Wermke, Noah Wöhler, Jan H. Klemmer, Marcel Fourné, Yasemin Acar, and Sascha Fahl. 2022. Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022 . IEEE, 1880-1896. -
  63. [96][96] Evan D Wolff, KatE M Growley, Maida O Lerner, Matthew B Welling, Michael G Gruden, and Jacob Canter. 2021. Navigating the SolarWinds supply chain attack. Procurement Law. 56 (2021), 3. -
  64. [97][97] Mengying Wu, Geng Hong, Wuyuao Mai, Xinyi Wu, Lei Zhang annd Yingyuan Pu, Huajun Chai, Lingyun Ying, Haixin Duan, and Min Yang. 2025. Exposing the Hidden Layer: Software Repositories in the Service of SEO Manipulation. In ICSE 2025: The 47th International Confenrece on Software Engineering . -
  65. [98][98] Cao Xiao, David Mandell Freeman, and Theodore Hwa. 2015. Detecting Clusters of Fake Accounts in Online Social Networks. In Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security, AISec 2015 . ACM, 91-101. -
  66. [99][99] Kai-Cheng Yang, Onur Varol, Clayton A Davis, Emilio Ferrara, Alessandro Flammini, and Filippo Menczer. 2019. Arming the public with artificial intelligence to counter social bots. Human Behavior and Emerging Technologies 1, 1 (2019), 48-61. -
  67. [100][100] Zhi Yang, Christo Wilson, Xiao Wang, Tingting Gao, Ben Y. Zhao, and Yafei Dai. 2014. Uncovering social network Sybils in the wild. ACM Trans. Knowl. Discov. Data 8, 1 (2014), 2:1-2:29. -
  68. [101][101] Nusrat Zahan, Parth Kanakiya, Brian Hambleton, Shohanuzzaman Shohan, and Laurie A. Williams. 2023. OpenSSF Scorecard: On the Path Toward EcosystemWide Automated Security Metrics. IEEE Secur. Priv. 21, 6 (2023), 76-88. Table 7: A non-exhaustive list of GitHub star merchants | Provider | Price / Star | Min Amount | (Claimed) Delivery Time | |------------|----------------|--------------|---------------------------| | Baddhi | $0.10 | 100 | ≤ 1 week | | BuyGitHub | $0.12 | 50 | hours | | FollowDeh | $0.12 | 20 | instant | | subme.lt | $0.67 | 100 | hours | | Box ID | $0.21 ∼ $ 0.41 | 100 | hours | | R for Rank | $0.38 | 100 | NA | | Twidium | $1.62 | 50 | 7 ∼ 30 days |
  69. [103][103] Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small World with High Risks: A Study of Security Threats in the npm Ecosystem. In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019 . USENIX Association, 995-1010.

Cited by

Sorted by citations

Metadata

Authors
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C.
Affiliations
  • Carnegie Mellon University (US)
  • North Carolina State University (US)
Venue
arXiv
Publisher
arXiv
Published
2024
Pages
1469-1481
ISSN
0270-5257 (ISSN-L)
OpenAlex
W7212252056
Cited by
4
References
2
Citations by year
2026: 4
FWCI
42.73
Type
conference paper
Language
en
Open access
Locations
  • ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Funders
National Science Foundation (2206859, 2207008, 2317168)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Computer Science Applications › Open Source Software Innovations
Keywords
GitHub, popularity metrics, anomaly detection, open source software, growth hacking, supply chain security, platform moderation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review