GitHub's fake star economy

Here are the things I look at in order:

* last commit date. Newer is better

* age. old is best if still updating. New is not great but tolerable if commits aren't rapid

* issues. Not the count, mind you, just looking at them. How are they handled, what kind of issues are lingering open.

* some of the code. No one is evaluating all of the code of libraries they use. You can certainly check some!

What does stars tell me? They are an indirect variable caused by the above things (driving real engagement and third interest) or otherwise fraud. Only way to tell is to look at the things I listed anyway.

I always treated stars like a bookmark "I'll come back to this project" and never thought of it as a quality metric. Years ago when this problem first surfaced I was surprised (but should not have been in retrospect) they had become a substitute for quality.

I hope the FTC comes down hard on this.

Edit:

* commit history: just browse the history to see what's there. What kind of changes are made and at what cadence.

Build a SaaS and you'll have "journalists" asking if they can include you in their new "Top [your category] Apps in [current year]", you just have to pay $5k for first place, $3k for second, and so on (with a promotional discount for first place, since it's your first interaction).

You'll get "promoters" offering to grow your social media following, which is one reason companies may not even realize that some of their own top accounts and GitHub stars are mostly bots.

You'll get "talent scouts" claiming they can find you experts exactly in your niche, but in practice they just scrape and spam profiles with matching keywords on platforms like LinkedIn once you show interest, while simultaneously telling candidates that they work with companies that want them.

And in hiring, you'll see candidates sitting in interview farms quite clearly in East Asia, connecting through Washington D.C. IPs, present themselves with generic European names, with synthetic camera backgrounds, who somehow ace every question, and list experience with every technology you mention in the job post in their CVs already (not hyperbole, I've seen exactly this happen).

If a metric or signal matters, there is already an ecosystem built to fake it, and faking it starts to be operational and just another part of doing business.

Specifically someone submitted a library that was only several days old, clearly entirely AI generated, and not particularly well built.

I noted my concerns with listing said library in my reply declining to do so, among them that it had "zero stars". The author was very aggressive and in his rant of a reply asked how many stars he needed. I declined to answer, that's not how this works. Stars are a consideration, not the be all end all.

You need real world users and more importantly real notability. Not stars. The stars are irrelevant.

This conversation happened on GitHub and since then I have had other developers wander into that conversation and demand I set a star count definition for my "vague notability requirement". I'm not going to, it's intentionally vague. When a metric becomes a target it ceases to be a good metric as they say.

I don't want the page to get overly long, and if I just listed everything with X star count I'd certainly list some sort of malware.

I am under no obligation to list your library. Stop being rude.

Are VC's just that lazy about making investment decisions? Is this yet another side-effect of ZIRP[2] and too much money chasing a return? Is nobody looking too hard in the hope of catching the next rocket to the moon?

From the outside, investing based on GitHub stars seems insane. Like, this can't be a serious way of investing money. If you told me you were going to invest my money based on GitHub stars, I'd laugh, and then we'd have an awkward silence while I realize there isn't a punchline coming.

[0] I'm from Cleveland. I get to pick on them.

[1] https://en.wikipedia.org/wiki/List_of_Cleveland_Browns_seaso... I think their record speaks for itself.

[2] https://en.wikipedia.org/wiki/Zero_interest-rate_policy

I think as a proxy it fails completely: astroturfing aside stars don't guarantee popularity (and I bet the correlation is very weak, a lot of very fundamental system libraries have small number of stars). Stars also don't guarantee the quality.

And given that you can read the code, stars seem to be a completely pointless proxy. I'm teaching myself to skip the stars and skim through the code and evaluate the quality of both architecture and implementation. And I found that quite a few times I prefer a less-"starry" alternative after looking directly at the repo content.

It’s easy to dunk on VCs, but the herd effect is rational after considering the typical VC’s background, the intense competition for good deals, and the job requirements — to prudently deploy capital.

Who wants to pitch their boss on investing $1-10M in a product no one uses, built by a team of anons?

This is not to defend the process, but merely explain it. It’s not so different from customer marketing. To win a VC, first understand the VC.

Once hired, VCs cannot easily get fired yet they exert immense strategic control.

Nonetheless, many founders interview summer interns harder than VCs.

Heuristic: after removing capital, would you hire the VC to be your boss?

Great VCs are worth the equity and will turbocharge startups. When you find one, don't haggle. Get a fair deal, and get right back to coding.

Bad VCs will destroy companies the same way soccer stars would destroy basketball teams if made the head coach.

- link: https://github.com/pathwaycom/pathway

- watch: 115, fork: 1.6k, star: 63.5k

- issues: 32, PR-s: 3

And compare to other ETL tool, like Apache Airflow - used by me and many machine learning folks:

- link https://github.com/apache/airflow

- watch: 777, forks 16.9k!!!!!, Stars: (only!) 45.1k

- issues: 1200 (!!!), PR-s (501!!!).

Why am I not surprised big Capital corrupts everything. Also, Goodhart's law applies again: "When a measure becomes a target, it ceases to be a good measure".

HN Folks: What reliant, diverse signals do you use to quickly eval a repo's quality? For me it is: Maintenance status, age, elegance of API and maybe commit history.

PS: From the article:

> instead tracks unique monthly contributor activity - anyone who created an issue, comment, PR, or commit. Fewer than 5% of top 10,000 projects ever exceeded 250 monthly contributors; only 2% sustained it across six months.

> [...] recommends five metrics that correlate with real adoption: package downloads, issue quality (production edge cases from real users), contributor retention (time to second PR), community discussion depth, and usage telemetry.

* https://arxiv.org/abs/2412.13459 (2024/2025) - Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware

In my opinion, nothing could be more wrong. GitHub's own ratings are easily manipulated and measure not necessarily the quality of the project itself, but rather its Popularity. The problem is that popularity is rarely directly proportional to the quality of the project itself.

I'm building a product and I'm seeing what important is the distribution and comunication instead of the development it self.

Unfortunately, a project's popularity is often directly proportional to the communication "built" around it and inversely proportional to its actual quality. This isn't always the case, but it often is.

Moreover, adopting effective and objective project evaluation tools is quite expensive for VCs.

you instantly got like 40k likes - but there was a catch

algorithm saw you getting a lot of likes from Iran/Pakistan, so went on recommending the post to those countries, got no response and stopped recommending said post altogether

in a sense, it became a self-regulating system, where fake impressions extinguish their very reason to be bought

It’s more expensive to compute, but the resulting scores would be more trustworthy unless I’m missing something.

As a side note it's kind of disheartening that everytime there is a metric related to popularity there would be some among us that will try to game it for profit, basically to manipulate our natural bias.

As a side note it's always a bit sad how the parasocial nature of the modern web make us like machine interfacing via simple widgets, becoming mechanical robot ourselves rationalising IO via simple metrics kind of forgetting that the map is never the territory.

Easily 1-3k stars per hackathon from student or hackathon participants for a cost of $1-5k. And some free marketing comes with too since participants may post on LinkedIn or other social media if they win something.

Need to move from skill downloads to skill usage.

It does feel like everything is a scam nowadays though. All the numbers seem fake; whether it's number of users, number of likes, number of stars, amount of money, number of re-tweets, number of shares issued, market cap... Maybe it's time we focus on qualitative metrics instead?

We should do a hall of shame!

https://www.youtube.com/@programmersarealsohuman5909

I'd give a lot of credit to Microsoft and the Github team if they went on a major ban/star removal wave of affected repos, akin to how Valve occasionally does a major sweep across CSGO2 banning verified cheaters.

- I think the zero follower account might be the weakest signal of a low quality account, I think I had zero followers for maybe 5+ years.

The way to beautify the pig is to put lipstick on the pig!

Github stars is akin to 'link popularity' or 'pagerank' which is ripe for abuse.

One way around it is to trust well known authors/users more. But it's hard to verify who is who. And accounts get bought/closed/hacked.

Another way is to hand over the algo in a way where individuals and groups can shape it, so there's no universal answer to everyone.

They make it easier to sort through options, help with search and discovery, and at least give you a baseline signal for trust can get better over time.

So to me, some signal better than no signal at all.

It’s supposed to get people to actually try your product. If they like it, they star it. Simple.

At that point, forcing the action just inflates numbers and strips them of any meaning.

Gaming stars to set it as a positive signal for the product to showcase is just SHIT.

This is just clearly...incorrect? You can both modify code without forking it and most software is distributed via a registry or binary download, which also wouldn't be represented in forks. For most projects, the number of forks is a lossy signal for how busy the contributor ecosystem is, nothing else.

I guess it's like fake followers on other social media platforms.

To me, it just reflects a behaviour that is typical of humans: in many situations, we make decisions in fields we don't understand, so we evaluate things poorly.

Stars only matter when there are very few, like if it has almost none, that’s a red flag. Otherwise it’s just noise.

I paid github for years to keep my repos private...

But then I don't participate in the stars "economy" anyway, I don't star and I don't count stars, so I'm probably irrellevant for this study.

Download counters are abused similarly and are even easier to inflate.

Understanding the real popularity of a project is now even harder with all the AI bots spamming about it.

Now that money is flowing to Github stars, no wonder people are buying fake "stars"? Seems capitalism is working as expected...

but i think based on their statement that north of 90% of the buying repos were terminated by github, i'd say there would be very very many more fake stars without any github intervention.

i guess i just wish they hadn't made the first words of the article "Six million fake stars" without putting that into scale.

"We ran our own analysis sampling 150 profiles per repo across 20 projects and found repos where 36-76% of stargazers have zero followers and fork-to-star ratios 10x below organic baselines"

This does not looks like appropriate signal to use on github, i doubt that this is organic baseline.If this is used as metric than study might be flawed.

...the "Likes" on a post - on FB, twttr, LI, HN, ...

...the "Hearts" on post

...the "bookmarks" on a post

...the "upvotes"

...its corollary, the "downvotes"

...the fake dollars in your fake game

...the fake lives in your fav fantasy game

...ad inf

We figured out a workaround to limit activity to prior contributors only, and add a CI job that pushes a coauthored commit after passing captcha on our website. It cut the AI slop by 90%. Full write-up https://archestra.ai/blog/only-responsible-ai

https://claude.com/contact-sales/claude-for-oss

> Who should apply:

> You’re a primary maintainer or core team member of a public repo with 5,000+ GitHub stars

I can't blame people for maximizing star counts when benefits like these are tied to them. This is a $200 a month subscription, and it did tempt me a bit... Can't imagine what people would do if some venture capitalist dangled millions in front of them. I suppose they'd do pretty much anything.

It's weird that people are using stars as a signal though. Anyone can star a repository, it's essentially a public bookmark. I think the real popularity signal is the number of people participating in the project.

> When nobody is forking a 157,000-star repository, nobody is using it

that is completely not true, i don't fork a repo when i use it, only when i want to contribute to it (and usually cleanup my forks)

> Runa Capital publishes the ROSS (Runa Open Source Startup) Index quarterly, ranking the 20 fastest-growing open-source startups by GitHub star growth rate. Per TechCrunch, 68% of ROSS Index startups that attracted investment did so at seed stage, with $169 million raised across tracked rounds. GitHub itself, through its GitHub Fund partnership with M12 (Microsoft's VC arm), commits $10 million annually to invest in 8-10 open-source companies at pre-seed/seed stages based partly on platform traction.

This all smells like BS. If you are going to do an analysis you need to do some sound maths on amount of investment a project gets in relation to github starts.

All this says is stars are considered is some ways, which is very far from saying that you get the fake stars and then you have investment.

This smells like bait for hating on people that get investment

The thing is, they are all scammers whose emails go unopened… and the tragic thing is, most likely the VCs would require the same treatment if they did get all hyped up and try to get involved in my project.

There is nobody real who's desperately trying to reach me to extend a line of business credit. I'm not working in AI, rather the opposite, was not in crypto, etc etc, so I know it is just email scams from beginning to end, dozens every day.

It's kind of pitiful that if VCs tried to jump in, they would be indistinguishable from the scams.

> As one commenter put it: "You can fake a star count, but you can't fake a bug fix that saves someone's weekend."

I'm curious what the research says here---can you actually structurally undermine the gamification of social influence scores? And I'm pretty sure fake bugfixes are almost trivial to generate by LLMs.

Just look at how many cool and legit open projects have the star-meter graph in their README.md - so of course people will start measuring against that metric and start gaming it.

I was surprised myself when I suddenly saw a starstruck badge on my profile. I never advertise my projects but I do feel honored when people think that my contributions are useful and stars are an easy way of showing that gratitude. At least I think that's how it was intended. And now someone is breaking that for scraps (or not scraps.)

This is exactly the bs that pushes services to not offer their own logins anymore, now you have to login with FB or GH or $randomFamousSvc instead of the more anonymous "by email" - just happened to me recently when I wanted to use a trial account, but I totally get it - with abuse trust is substituted with control. It's the same everywhere.. even voter ID.

Sorry, that went off track. I guess just don't look at the stars anymore. Wait, no, don't do that, stars are beautiful and so are you if you read all the way to here. Here's a * for you :)

“gstack is not a hypothetical. It’s a product with real users:

75,000+ GitHub stars in 5 weeks

14,965 unique installations (opt-in telemetry, so real number is at least 2x higher)

305,309 skill invocations recorded since January 2026

~7,000 weekly active users at peak”

GitHub stars are a meaningless metric but I don’t think a high star count necessarily indicates bought stars. I don’t think Garry is buying stars for his project.

People star things because they want to be seen as part of the in-crowd, who knows about this magical futuristic technology, not because they care to use it.

Some companies are buying stars, sure, but the methodology for identifying it in this article is bad.