Author: Claude, Deep Tide TechFlow

Deep Tide Guide: Research from Carnegie Mellon University (CMU) found that approximately 6 million fake Stars exist on GitHub, involving 18,600 repositories and 301,000 accounts, with AI/LLM projects being the largest category of non-malicious star farming. The market price for fake Stars is as low as $0.03 each, while Redpoint data shows that the median number of Stars for VC seed-stage projects is 2,850—meaning one can “buy” a false popularity threshold for less than $200.

GitHub Stars are becoming a carefully packaged scam.

According to an investigative report released by Awesome Agents on April 13, a mature gray industrial chain surrounding GitHub Stars is operating in plain sight: academic papers quantify the scale of the issue, over a dozen websites openly sell Stars, and venture capital firms directly incorporate the number of Stars into project selection decisions.

The investigative team independently verified 20 repositories and found that 36% to 76% of Stars for some projects came from zero-follower accounts, with the ratio of forks to stars being less than one-tenth of the organic project baseline.

The core academic support for this report comes from a peer-reviewed paper jointly published by CMU, North Carolina State University, and Socket at ICSE 2026 (International Conference on Software Engineering). The research team developed a detection tool, StarScout, that analyzed 20TB of GitHub metadata (6.7 billion events, 326 million Stars, covering 2019 to 2024), ultimately marking about 6 million suspicious fake Stars, 18,600 implicated repositories, and around 301,000 participating accounts.

6 Million Fake Stars: Explosive Growth in 2024, AI Projects Hardest Hit

Fake Stars are not a new phenomenon, but their scale experienced explosive growth in 2024. CMU paper data shows that before 2022, fewer than 10 repositories were involved in fake Star activities each month, which skyrocketed to 3,216 repositories and 30,779 participating accounts by the peak in July 2024. As of July 2024, 16.66% of repositories with over 50 Stars had participated in fake Star activities.

The accuracy of the research team’s detection was indirectly validated by GitHub's own actions: 90.42% of the repositories marked by StarScout have been deleted, and 57.07% of the flagged accounts have been cleaned up.

In the categorization of fake Stars' uses, most are used to promote short-lived phishing malware repositories. However, in the non-malicious category, AI and LLM-related projects ranked first, with a total of 177,000 fake Stars, exceeding the number for blockchain/cryptocurrency projects. The paper notes that “many of these projects are academic paper repositories or products from LLM-related startups.” More critically, 78 repositories detected with fake Star activity have appeared on the GitHub Trending page, proving that purchased Stars can indeed successfully manipulate the platform's recommendation algorithms.

Every Star Costs at Least 3 Cents: Publicly Operated Star Farming Market

This is not dark web trading. The investigative report confirms that at least a dozen websites openly sell GitHub Stars, including SocialPlug.io, Buy.fans, Boost-Like.store, and others. There are 24 active Star farming services on Fiverr, ranging from $5 basic packages to over $25 for “organic promotion” packages.

Pricing is divided into three tiers: low-cost tier (one-time new account) at $0.03 to $0.10 per Star, mid-range $0.20 to $0.50, and premium tier (accounts with years of history) at $0.80 to $0.90 per Star. Premium services promise “no lost Stars” and a 30-day replenishment guarantee. SocialPlug claims to have delivered a cumulative total of 3.1 million Stars, serving over 53,000 customers, and even provides API support for programmatic bulk purchases.

Star exchange platforms like GithubStarMate.com and SafeStarExchange.com adopt a points-based mutual exchange model, allowing users to exchange Stars without spending money. There are also at least 7 open-source tools on GitHub (such as fake-git-history, commit-bot, etc.) specifically used to fabricate contribution record charts. Pre-made GitHub accounts with 5 years of commit history and Arctic Code Vault contributor badges are priced at about $5,000 on Telegram.

A 2020 study from Tsinghua University recorded the operations of QQ and WeChat promotion groups in China: groups with over 1,020 members handled about 20 repository star farming tasks daily, estimating annual industry profits between $3.4 million and $4.4 million.

VC Uses Stars for Project Screening, $200 Can “Qualify” for Seed Round

The relationship between Stars and funding is not a guess; it is publicly acknowledged by venture capital firms themselves.

Jordan Segall, a partner at Redpoint Ventures, analyzed 80 developer tool companies and found that the median number of GitHub Stars at the seed stage is 2,850, while at Series A it is 4,980. He explicitly stated: “Many VCs write internal crawling scripts to find GitHub projects with rapid Star growth; Stars are their most frequently monitored metric.”

This set of numbers effectively gives startups a precise procurement list. Using cheap Stars for calculation, spending $85 to $285 can generate 2,850 Stars to reach the seed round median; spending $990 to $4,500 can reach the Series A threshold. Compared to the typical funding scale of $1 million to $10 million for seed rounds, the return on investment ratio ranges between 3,500 times to 117,000 times.

The ROSS index (open-source startup ranking) published quarterly by Runa Capital further amplifies this incentive. According to TechCrunch, 68% of the companies on the ROSS index received investment at the seed stage, with total tracked funding reaching $169 million. An independent analysis of the investigative report found that Union Labs, which ranked first in the Q2 2025 ROSS index (with a 54.2-fold increase in Stars, totaling 74,300 Stars), has serious allegations of star farming: 32.7% of Stars came from zero-repository accounts, 52% came from zero-follower accounts, and 47.4% of the Stars were flagged as suspicious by StarScout. An industry ranking widely cited by VCs shows that nearly half of the top project's Stars are suspected of being fake.

Actual cases have already corroborated the conversion chain from Stars to funding: Lovable (formerly GPT Engineer) raised $7.5 million in pre-seed with over 50,000 Stars, A round valued at $1.8 billion; Browser-use raised $17 million in seed funding after gaining 50,000 Stars in three months; Pangolin entered Y Combinator with 1,000 Stars, completing $4.7 million in seed funding within eight months.

Asymmetric Enforcement by GitHub: Deleting Repositories But Leaving Accounts

GitHub's acceptable use policy clearly prohibits “fake interactions,” “ranking manipulation,” and establishing secondary markets for fake Stars, even specifically banning star farming incentivized by “cryptocurrency airdrops.”

However, enforcement is passive and asymmetric. GitHub deleted 90.42% of the repositories marked by StarScout but only cleaned 57.07% of the flagged accounts. The “labor force” of the fake Star industry remains largely intact. After the Dagster 2023 investigative report was published, related fake Star accounts were deleted within 48 hours—this was a reaction to public exposure, not the result of proactive detection.

The CMU research team suggests that GitHub adopt a weighted popularity metric based on network centrality to replace the raw Star count, fundamentally dismantling the fake Star economy. GitHub has yet to implement this.

This forms a self-reinforcing closed loop: VCs use Stars as filtering signals → startups farm Stars → VCs see false heat → more VCs adopt Star tracking → more startups farm Stars. The benchmark numbers publicly released by Redpoint (2,850 for seed rounds, 4,980 for A rounds) effectively give startups a clear pricing list for purchases.

As one commenter in the investigative report said: “The number of Stars can be faked, but a bug fix that saves someone’s weekend cannot be faked.”