I found 560 malware repos while building a GitHub trending site. GitHub removed them in a day

A developer behind Upstar, a site that ranks GitHub repositories by star velocity, uncovered a coordinated campaign of roughly 560 malware-distributing repos across 478 accounts that were gaming the trending rankings. After a single report to GitHub Trust & Safety on November 1, GitHub removed 559 accounts in under 24 hours. The repos, which sat around 300 stars each to evade detection thresholds, lured readers into running obfuscated commands served from four domains, with a second batch using GitHub Actions to compile tiny placeholder programs into 67 MB executables.

I build Upstar https://upstar.dev , a site that ranks GitHub repositories by how fast they gain stars within each topic. The idea is simple: a small project that suddenly takes off should be able to outrank a giant that grows slowly. Ranking by growth has an obvious weakness, though. Fast growth is exactly what fake projects try to manufacture. Last weekend I found out how far that goes. Upstar runs a daily data-quality check. On Saturday it flagged a handful of repos that had no business being in a ranking: "pre-activated" versions of KMS activators, Adobe After Effects, Cubase, Microsoft Project, a MetaTrader "bot". They were sitting quietly in the Python rankings, around 300 stars each. I asked Claude Code to look for the same pattern across every README in Upstar's database. 17 became 309. By the time I wrote the report, the count was 479 repositories on 478 accounts . Every README asked the reader to do two things: In about half of them, the domain name was split into pieces and glued back together inside the command, so it never appeared as one string. I'm not reproducing any of the commands here. The scripts were served from four domains, the busiest being git-software . cc and shell-activation . top . While checking, we found 81 more repos built differently. Each contained a tiny placeholder program, about 1.6 KB, that GitHub Actions compiled into a 67 MB executable, complete with checksums and an MIT license, so it looked legitimate. The README, meanwhile, sent readers to a MediaFire folder for the "real" installer. All 70 accounts of the first batch were created on the same day. This is the uncomfortable part. Upstar only scanned READMEs for bait above 500 stars, and these repos were designed to stay around 300. At one point, 31 of the 200 fastest-rising projects on Upstar belonged to the campaign , and 220 of the repos were visible on topic pages. Coordinated stars are cheap, and a growth ranking rewards them. On November 1, I sent one report to GitHub Trust & Safety, with the full list in a secret gist. From one report to 559 removed accounts in under 24 hours. That's a genuinely good response. If something trending on GitHub ticks two of these boxes, report it. It takes five minutes, and GitHub does act. Upstar ranks GitHub repos by star velocity within each topic, and now screens out this kind of bait automatically: upstar.dev https://upstar.dev