Anyone can buy GitHub stars for as little as ten cents each, so I judge open-source startups by the people who actually use and improve their code.
For as little as $10, you can buy 100 stars for a project on GitHub. A team of researchers led by Carnegie Mellon University found sellers charging between $0.10 and $2.00 per star, often promising delivery within days or even hours. After going through GitHub's public activity records from July 2019 to December 2024, they found about 6 million suspected fake stars and 18,617 projects that ran fake star campaigns.
My name is Alexander Kopylkov, and I invest in technology companies, including developer tools. The study was presented in April 2026 at the International Conference on Software Engineering, and it is a good reason to give star counts much less weight. It should matter to anyone who writes code, and to anyone who funds it.
A GitHub star is cheap to fake.
If you have never used GitHub, a star works a lot like a bookmark. It helps you find a project again later, and it costs one click. Over the years, a big star count became a quick way to say "lots of people trust this."
That made stars worth faking. The paper notes that some startups buy stars because investors and managers look at them to judge whether a product is viable. So investors are part of the reason this market exists.
GitHub's own rules already forbid this. Its Acceptable Use Policies ban "rank abuse, such as automated starring or following." The researchers found that fake star campaigns still became far more common in 2024 than the year before.
Bought stars fade fast, and many lead to malware.
The study found that most fake stars were used to promote short-lived phishing and malware projects. By January 2025, 90.42% of the projects caught in these campaigns had already been removed from GitHub. Judging by their names, many of the removed ones appear to have posed as pirated software, game cheats or cryptocurrency bots.
Of the projects still online, about 30% were spam or malware. Most of the rest were AI, blockchain, tool and tutorial projects, the areas where hype runs highest.
For developers, this is a safety issue. A project with thousands of stars feels safe to download without a second look. For investors, it is a measurement issue. A number that scammers can produce this cheaply says very little about a real team.
The finding I found most useful is about results. Fake stars can bring a project some real attention, but only for less than two months, and the boost is about five times smaller than the one real stars bring. Over the long term, buying fake stars had a negative effect on how many real stars a project went on to gain.
The authors write that star counts "should not be used for high-stakes decisions by themselves." Deciding where to invest money is about as high-stakes as it gets.
I look for signs that people depend on the code.
When I look at an open-source startup, I ask questions that are much harder to fake:
Who outside the founding team sends improvements to the code, and do they keep coming back? How quickly does the team answer the problems users report? Which companies run the project inside their own products, and would they notice if it broke tomorrow? Is anyone paying for hosting, support or extra features yet?
These answers rarely fit into one number on a slide, and that is fine. A founder who can name ten companies using the project, and explain how each one found it, gives me something I can check with a few phone calls.
The researchers give founders similar advice. They recommend putting the effort into building a real community around the code.
In the end, steady usage is the number that holds up.
The paper opens with an idea the social scientist Donald T. Campbell wrote down in 1979: the more a number is used to make decisions, the more pressure there is to corrupt it. Stars are a clear example. They became important, so people started faking them.
The fix is to look at what people do after the first click. Do they install the code, build on it and keep coming back? Those habits take months to form, and that is what makes them worth paying attention to.
My advice to developers who want to raise money for an open-source project is simple. Spend your energy on the people using your code. The investors worth working with will ask about them first.
Top comments (0)