一句话：构建 StarScout 对 2019–2024 年 GitHub 全量元数据做纵向测量，揭示虚假星标在 2024 年激增，多用于推广钓鱼恶意仓库且长期无益。
GitHub 的 star 数是最常用的流行度信号，却可被人工刷高，降低决策价值并带来安全风险。本文对 GitHub 虚假星标进行系统、全球、纵向测量，构建可扩展工具 StarScout，检测 2019–2024 年全量 GitHub 元数据中的异常星标行为。分析发现：虚假星标活动在 2024 年迅速激增；相关账户和仓库活动模式高度琐碎；多数虚假星标用于推广短命的钓鱼恶意仓库，其余多用于推广 AI/LLM、区块链、工具/应用和教程/演示仓库；虚假星标仅有不到两个月的短期推广效果，长期则成为负担。研究对平台审核、开源实践者和供应链安全研究者具有启示。
GitHub, the de facto platform for open-source software development, provides a set of social-media-like features to signal high-quality repositories. Among them, the star count is the most widely used popularity signal, but it is also at risk of being artificially inflated (i.e., faked), decreasing its value as a decision-making signal and posing a security risk to all GitHub users. In this paper, we present a systematic, global, and longitudinal measurement study of fake stars in GitHub. To this end, we build StarScout, a scalable tool able to detect anomalous starring behaviors across all GitHub metadata between 2019 and 2024. Analyzing the data collected using StarScout, we find that: (1) fake-star-related activities have rapidly surged in 2024; (2) the accounts and repositories in fake star campaigns have highly trivial activity patterns; (3) the majority of fake stars are used to promote short-lived phishing malware repositories; the remaining ones are mostly used to promote AI/LLM, blockchain, tool/application, and tutorial/demo repositories; (4) while repositories may have acquired fake stars for growth hacking, fake stars only have a promotion effect in the short term (i.e., less than two months) and become a liability in the long term. Our study has implications for platform moderators, open-source practitioners, and supply chain security researchers.
@inproceedings{paperbot11512,
title = {Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware},
author = {Hao He and Haoqin Yang and Philipp Burckhardt and Alexandros Kapravelos and Bogdan Vasilescu and Christian Kästner},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3764531}
}