Over 3.1 Million Fake GitHub Stars Used to Promote Malware

A recent study revealed over 3.1 million fake "stars" on GitHub, used to artificially inflate the popularity of scam and malware repositories. Researchers used a tool called StarScout to analyze massive datasets, identifying 278,000 accounts responsible for these fake stars across 15,835 repositories. This deceptive practice, particularly rampant in 2024, allows malicious projects to appear legitimate and reach unsuspecting users. While GitHub has removed many of the implicated accounts and repositories, the problem persists. Users are urged to carefully evaluate project quality and exercise caution when downloading software from GitHub.