GitHub's Fake Star Economy

TL;DR

• A peer-reviewed CMU study (ICSE 2026) found 6 million fake starsacross 18,617 repositories using 301,000 accounts - with AI/LLM repos the largest non-malicious category - Stars sell for $0.03 to $0.85 eachon at least a dozen websites, Fiverr gigs, and Telegram channels - no dark web required - VCs explicitly use stars as sourcing signals: Redpoint found the median star count at seed is 2,850, and firms run automated scrapers to find fast-growing repos - We ran our own analysis sampling 150 profiles per repo across 20 projects and found repos where 36-76% of stargazers have zero followersand fork-to-star ratios 10x below organic baselines - The FTC's 2024 rule banning fake social influence metrics carries penalties of $53,088 per violation- and the SEC has already charged startup founders for inflating traction metrics during fundraising

A GitHub star costs $0.06 at the low end. A seed round unlocks $1 million to $10 million. The math is obvious, and thousands of repositories are exploiting it.

This investigation maps the full ecosystem: from the peer-reviewed research quantifying the problem, to the marketplaces selling stars openly, to the venture capital pipeline that converts star counts into funding decisions. We ran our own analysis on 20 repositories using the GitHub API, sampling thousands of stargazer profiles to independently verify which projects show fingerprints of manipulation - and which don't.

The picture that emerges is a mature, professionalized shadow economy operating in plain sight.

Six million fake stars

The definitive account comes from a peer-reviewed study presented at ICSE 2026 by researchers at Carnegie Mellon University, North Carolina State University, and Socket. Their tool, StarScout, analyzed 20 terabytes of GitHub metadata - 6.7 billion events and 326 million stars from 2019 to 2024 - and identified approximately 6 million suspected fake stars distributed across 18,617 repositories by roughly 301,000 accounts.

The problem accelerated dramatically in 2024. By July, 16.66% of all repositories with 50 or more stars were involved in fake star campaigns - up from near-zero before 2022. The researchers' detection proved accurate: 90.42% of flagged repositories and 57.07% of flagged accounts had been deleted as of January 2025, confirming GitHub itself recognized these as illegitimate.

AI and LLM repositories emerged as the largest non-malicious category of fake-star recipients, ahead of blockchain/cryptocurrency projects in absolute volume at 177,000 fake stars. The study notes that "many of which are academic paper repositories or LLM-related startup products." Critically, 78 repositories with detected fake star campaigns appeared on GitHub Trending, proving that purchased stars successfully game the platform's discovery algorithm.

Earlier foundational work includes Dagster's March 2023 investigation, where engineers purchased stars from two vendors to study the phenomenon. They found services via basic Google search. A premium vendor - GitHub24, a registered German company (Moller und Ringauf GbR) - charged EUR 0.85 per star and delivered reliably, with all 100 stars persisting after one month. A budget service (Baddhi Shop) sold 1,000 stars for $64, though only 75% survived.

The marketplace

The star-selling ecosystem spans dedicated websites, freelance platforms, exchange networks, and underground channels. At least a dozen active websites sell GitHub stars directly, including SocialPlug.io, Buy.fans, Boost-Like.store, GitHubPromoter.com, Followdeh.com, and Vurike.com.

| Tier | Price per star | Delivery | Account quality | |---|---|---|---| | Budget (disposable accounts) | $0.03 - $0.10 | Days | New, empty profiles | | Mid-range | $0.20 - $0.50 | 1-2 weeks | Some activity history | | Premium (aged accounts) | $0.80 - $0.90 | Gradual, "natural" delivery | Years-old profiles with repos and contributions |

On Fiverr, 24 active gigs sell GitHub promotion, with packages from $5 for basic stars and forks to $25+ for "organic promotion." Many use obfuscated language to evade platform filters. Star exchange platforms like GithubStarMate.com and SafeStarExchange.com - both live and operational - enable free mutual starring through credit-based systems.

The infrastructure extends beyond stars. At least seven open-source tools on GitHub (fake-git-history, commit-bot, Commiter, and others) exist specifically to fabricate GitHub contribution graphs. Pre-built GitHub profiles with five-year commit histories and Arctic Code Vault Contributor badges sell for approximately $5,000 on Telegram.

Some vendors offer replacement guarantees - Followdeh advertises 30-day coverage, and premium services promise "non-drop" stars that survive GitHub's detection systems. SocialPlug claims 3.1 million stars delivered across 53,000+ clients and offers a formal API for programmatic purchasing.

A Tsinghua University study (ACSAC 2020) documented Chinese QQ and WeChat promotion groups with 1,020+ members processing roughly 20 repos per day, generating an estimated $3.4 to $4.4 million annually in promoter profits.

Our analysis: what fake stargazers look like

To move beyond reported statistics, we built a GitHub API analysis tool and ran it against 20 repositories: projects flagged by StarScout, fast-growing AI repos from the Runa Capital ROSS Index, and known organic baselines. For each repo, we sampled 150 stargazer profiles and measured account age, public repos, followers, and bio presence.

The fingerprints of manipulation are unmistakable once you know what to look for.

The baseline: what organic looks like

| Metric | Flask (71K stars) | LangChain (133K) | AutoGPT (183K) | |---|---|---|---| | Median account age | 4,801 days | 2,967 days | 4,022 days | | Zero public repos | 5.3% | 5.9% | 2.0% | | Zero followers | 10.0% | 11.8% | 5.9% | | Ghost accounts | 1.3% | - | - | | Suspicious accounts | 0.0% | 0.0% | 0.0% | | Fork-to-star ratio | 0.235 | 0.155 | 0.090 | | Watcher-to-star ratio | 0.029 | 0.006 | 0.005 |

Organic repositories are starred by developers who have been on GitHub for years, maintain their own projects, and follow other users. Ghost accounts - zero repos, zero followers, no bio - make up about 1% of a healthy project's stargazer base.

The manipulated: blockchain repos

| Metric | Union Labs (74K) | Shardeum (32K) | FreeDomain (157K) | Anoma (34K) | |---|---|---|---|---| | Median account age | 1,180d | 997d | 1,042d | 1,071d | | Zero public repos | 32.7% | 38.0% | 28.0% | 35.3% | | Zero followers | 52.0% | 59.3% | 81.3% | 62.0% | | Ghost accounts | 19.3% | 28.7% | 28.0% | 26.7% | | Fork-to-star ratio | 0.052 | 0.022 | 0.017 | 0.121 | | Watcher-to-star ratio | 0.022 | 0.009 | 0.001 | 0.006 |

These repos share a distinctive fingerprint. The accounts aren't obviously new - median ages of 1,000+ days - so they pass simple "young account" filters. But they're empty: a third have zero repos, half to four-fifths have zero followers, and a quarter are complete ghosts. These are aged accounts purchased or farmed specifically for star campaigns.

The fork-to-star ratio is the strongest signal. Flask has 235 forks per 1,000 stars. Shardeum has 22. FreeDomain has 17. When nobody is forking a 157,000-star repository, nobody is using it. The watcher-to-star ratio tells the same story: FreeDomain's 0.001 means that for every 1,000 people who starred the repo, just one actually watches it for updates.

FreeDomain is worth isolating: 157,000 stars, but only 168 watchers and 2,676 forks. That's a watcher-to-star ratio 26x lower than Flask. 81.3% of sampled stargazers have zero followers. This is a repository where almost nobody who starred it has any visible presence on GitHub.

Union Labs is the most consequential case. It was ranked #1 on Runa Capital's ROSS Index for Q2 2025 - a widely cited