“the majority of fake stars are used to promote short-lived malware repositories masquerading as pirating software, game cheats, or cryptocurrency bots”
The researchers built StarScout and found 4.5 million suspected fake stars, with the activity surging in 2024. The stars mostly push malware, and the fake stargazer profiles look like average GitHub users. Star count is the trust signal developers use to pick dependencies. GitHub built a popularity contest and the malware authors are winning it.