I build Upstar, a site that ranks GitHub repositories by how fast they gain stars within each topic. The idea is simple: a small project that suddenly takes off should be able to outrank a giant that grows slowly.
Ranking by growth has an obvious weakness, though. Fast growth is exactly what fake projects try to manufacture. Last weekend I found out how far that goes.
It started with 17 "installers"
Upstar runs a daily data-quality check. On Saturday it flagged a handful of repos that had no business being in a ranking: "pre-activated" versions of KMS activators, Adobe After Effects, Cubase, Microsoft Project, a MetaTrader "bot". They were sitting quietly in the Python rankings, around 300 stars each.
I asked Claude Code to look for the same pattern across every README in Upstar's database. 17 became 309. By the time I wrote the report, the count was 479 repositories on 478 accounts.
What they looked like
- Throwaway accounts: random word-salad usernames, no followers, one or two commits.
- Waves: 132 repositories created within about two hours on October 29, and 322 more over the next three days.
- Bought stars: 450 of the 479 gained between 80 and 400 stars within days of creation.
- The bait: free "pre-activated" paid software (Adobe, Autodesk, Office, FL Studio, CCleaner, phone unlocking tools), game cheats, crypto "bots".
How the trap worked
Every README asked the reader to do two things:
- paste a PowerShell command that downloads a script from a domain outside GitHub and runs it in memory;
- turn off Windows Security's real-time protection first.
In about half of them, the domain name was split into pieces and glued back together inside the command, so it never appeared as one string. I'm not reproducing any of the commands here. The scripts were served from four domains, the busiest being git-software[.]cc and shell-activation[.]top.
A second, quieter wave
While checking, we found 81 more repos built differently. Each contained a tiny placeholder program, about 1.6 KB, that GitHub Actions compiled into a 67 MB executable, complete with checksums and an MIT license, so it looked legitimate. The README, meanwhile, sent readers to a MediaFire folder for the "real" installer. All 70 accounts of the first batch were created on the same day.
How they got into my rankings
This is the uncomfortable part. Upstar only scanned READMEs for bait above 500 stars, and these repos were designed to stay around 300. At one point, 31 of the 200 fastest-rising projects on Upstar belonged to the campaign, and 220 of the repos were visible on topic pages. Coordinated stars are cheap, and a growth ranking rewards them.
Reporting it
On November 1, I sent one report to GitHub Trust & Safety, with the full list in a secret gist.
- About four hours later: "Our team is currently investigating."
- The next morning, they asked for the full list of accounts, and I sent all 559.
- A few hours after that, the review was concluded, and every account from both reports was gone.
From one report to 559 removed accounts in under 24 hours. That's a genuinely good response.
What I changed on Upstar
- README scanning for bait now runs on every repo, whatever its star count.
- A README that runs a remote script and asks you to disable your antivirus is treated as a lure, full stop. No legitimate project asks for both.
- Links to anonymous file hosts count only when they come with other red flags, such as a brand-new account or a handful of commits, so real projects that host big files elsewhere aren't caught.
- A block now follows the repository's ID, so renaming or transferring a repo doesn't get it back in.
How to spot one yourself
- A paid product offered "free", "pre-activated" or "cracked".
- The download lives outside GitHub: a MediaFire link, a random domain, a one-line PowerShell installer.
- Any instruction to turn off your antivirus. That alone is enough to walk away.
- A brand-new account, no followers, one or two commits, and hundreds of stars in a few days.
- A "release" binary that the repository's own code obviously can't produce.
If something trending on GitHub ticks two of these boxes, report it. It takes five minutes, and GitHub does act.
Upstar ranks GitHub repos by star velocity within each topic, and now screens out this kind of bait automatically: upstar.dev
Top comments (0)