Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware
2024/12/18 by Hao He, He, Hao, Haoqin Yang +9 · 21 voices · 1 citation
#cs.CR #cs.SE
paper · pdf · doi:10.1145/3744916.3764531
Abstract
GitHub, the de facto platform for open-source software development, provides a set of social-media-like features to signal high-quality repositories. Among them, the star count is the most widely used popularity signal, but it is also at risk of being artificially inflated (i.e., faked), decreasing its value as a decision-making signal and posing a security risk to all GitHub users. In this paper, we present a systematic, global, and longitudinal measurement study of fake stars in GitHub. To this end, we build StarScout, a scalable tool able to detect anomalous starring behaviors across all GitHub metadata between 2019 and 2024. Analyzing the data collected using StarScout, we find that: (1) fake-star-related activities have rapidly surged in 2024; (2) the accounts and repositories in fake star campaigns have highly trivial activity patterns; (3) the majority of fake stars are used to promote short-lived phishing malware repositories; the remaining ones are mostly used to promote AI/LLM, blockchain, tool/application, and tutorial/demo repositories; (4) while repositories may have acquired fake stars for growth hacking, fake stars only have a promotion effect in the short term (i.e., less than two months) and become a liability in the long term. Our study has implications for platform moderators, open-source practitioners, and supply chain security researchers.
Cited by
Discussions
- 4.5M Suspected Fake Stars in GitHub [hn, 236 points, 212 comments]
- 4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Malware [lemmy, 130 points, 8 comments]
- GitHub stars unfortunately is still an important indicator for developers to compare and choose which tools to use. Can we measure the “organic stars”? The original arXiv paper is worth reading: arxiv [bsky, 14 points, 2 comments]
- 4.5M GitHub Fake Stars: Growing Spiral of Popularity Contests, Scams and Malware [hn, 5 points, 1 comments]
- 🚨 Researchers uncover 4.5M fake stars on GitHub 🌟, often boosting malware disguised as pirated software & crypto bots. Fake stars surge in 2024, posing major risks to open-source trust & security. [bsky, 5 points, 0 comments]
- The fake stars on GitHub have gotten out of hand too. arxiv.org/abs/2412.13459 [bsky, 5 points, 2 comments]
- 4.5M Fake Stars in GitHub: Popularity Contests, Scams, and Malware [pdf] [hn, 4 points, 2 comments]
- 4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Malware 1 star = $0.1. arxiv.org/abs/2412.13459 [bsky, 2 points, 0 comments]
- Interesting research regarding #GitHub stars and how they are faked to promote repos. It comes with an Open Source tool written in Python to find suspicious stars throughout GitHub repositories: arxiv [bsky, 2 points, 0 comments]
- 4.5M Suspected Fake Stars in GitHub | arxiv.org/abs/2412.13459 [bsky, 1 points, 0 comments]
- "4.5M Suspected Fake Stars in GitHub" Many people are starting to think that the star count on GitHub is not trustworthy. Some even believe companies manipulate it for their own gain. This can make i [bsky, 1 points, 0 comments]
- 4.5M Suspected Fake Stars in GitHub #HackerNews arxiv.org/abs/... [bsky, 1 points, 1 comments]
- 4.5M Suspected Fake Stars in GitHub (arxiv.org) Main Link | Discussion [bsky, 1 points, 0 comments]
- Et bientôt ça pourrait être considéré comme une fraude aux investisseurs, de gonfler ses étoiles GitHub en en achetant… Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Con [bsky, 0 points, 0 comments]
- An academic study finds that about 4.5 M Github project stars were sold by half a dozen underground merchants. arxiv.org/abs/2412.13459 [bsky, 0 points, 0 comments]
- Something I noticed a lot in 2024: fake stars on GitHub have gotten ridiculous over the past year [bsky, 0 points, 0 comments]
- This paper reveals the existence of fake accounts and their characteristics on #GitHub. These newly created projects and accounts seem to be circumventing these features in order to create fraud late [bsky, 0 points, 0 comments]
- 4.5M Suspected Fake Stars in GitHub https://arxiv.org/abs/2412.13459 [comments] [106 points] [bsky, 0 points, 0 comments]
- 4.5M Suspected Fake Stars in GitHub https://arxiv.org/abs/2412.13459 https://news.ycombinator.com/item?id=42540182 [bsky, 0 points, 0 comments]
- Interesting study. Although there's PRs, Issues, contributors, last commit dates, etc, there's no denying that stars play a big role in evaluating repos in GitHub. arxiv.org/pdf/2412.13459 [bsky, 0 points, 0 comments]
- 4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Malware arxiv.org/abs/2412.13459 [bsky, 0 points, 0 comments]
Related