I build Upstar, a site that ranks GitHub repositories by how fast they gain stars within each topic. The idea is simple: a small project that suddenly takes off should be able to outrank a giant that grows slowly.
Ranking by growth has an obvious weakness, though. Fast growth is exactly what fake projects try to manufacture. Last weekend I found out how far that goes.
Upstar runs a daily data-quality check. On Saturday it flagged a handful of repos that had no business being in a ranking: "pre-activated" versions of KMS activators, Adobe After Effects, Cubase, Microsoft Project, a MetaTrader "bot". They were sitting quietly in the Python rankings, around 300 stars each.
I asked Claude Code to look for the same pattern across every README in Upstar's database. 17 became 309. By the time I wrote the report, the count was 479 repositories on 478 accounts.
Every README asked the reader to do two things:
In about half of them, the domain name was split into pieces and glued back together inside the command, so it never appeared as one string. I'm not reproducing any of the commands here. The scripts were served from four domains, the busiest being git-software[.]cc and shell-activation[.]top.
While checking, we found 81 more repos built differently. Each contained a tiny placeholder program, about 1.6 KB, that GitHub Actions compiled into a 67 MB executable, complete with checksums and an MIT license, so it looked legitimate. The README, meanwhile, sent readers to a MediaFire folder for the "real" installer. All 70 accounts of the first batch were created on the same day. This is the uncomfortable part. Upstar only scanned READMEs for bait above 500 stars, and these repos were designed to stay around 300. At one point, 31 of the 200 fastest-rising projects on Upstar belonged to the campaign, and 220 of the repos were visible on topic pages. Coordinated stars are cheap, and a growth ranking rewards them.
On November 1, I sent one report to GitHub Trust & Safety, with the full list in a secret gist.
From one report to 559 removed accounts in under 24 hours. That's a genuinely good response.
If something trending on GitHub ticks two of these boxes, report it. It takes five minutes, and GitHub does act.
Upstar ranks GitHub repos by star velocity within each topic, and now screens out this kind of bait automatically: upstar.dev