GitHub’s Fake Engagement Problem Is Hiding in Plain Sight
This threat describes a widespread fake engagement problem on GitHub where bot accounts artificially inflate star counts on repositories, primarily targeting low-quality AI tools and executor software. A detection tool named phantomstars identifies these campaigns by analyzing account creation dates, activity patterns, and coordinated timing of star events. The fake engagement distorts the credibility signals developers rely on to evaluate and recommend software. No direct exploitation or vulnerability is described, but the manipulation impacts trust and decision-making in the open source ecosystem.
AI Analysis
Technical Summary
The threat involves coordinated fake engagement campaigns on GitHub, where large groups of newly created bot accounts with minimal profile information star the same repository within a short time window. The phantomstars tool uses GitHub Actions and the GraphQL API to detect these campaigns by scoring accounts on factors such as account age, profile completeness, repository activity, and timing clusters. When a campaign is detected, an issue is automatically filed on the targeted repository to notify maintainers. This manipulation inflates star counts, misleading users about the quality and popularity of repositories, especially low-quality AI-related projects.
Potential Impact
The impact is primarily reputational and informational, as fake stars can mislead developers into trusting or depending on low-quality or potentially harmful software. This undermines the integrity of GitHub's social signals used for software evaluation. There is no indication of direct exploitation or compromise of systems. The problem affects the open source community's ability to discern genuine project popularity and quality.
Mitigation Recommendations
No official patch or fix is applicable as this is a manipulation of social signals rather than a software vulnerability. The phantomstars tool provides a detection and notification mechanism to alert repository maintainers of suspicious engagement. Repository maintainers can monitor issues filed by such tools and consider disabling stars or taking other repository-level actions if fake engagement is confirmed. Users should remain cautious about relying solely on star counts for evaluating repositories.
GitHub’s Fake Engagement Problem Is Hiding in Plain Sight
Description
This threat describes a widespread fake engagement problem on GitHub where bot accounts artificially inflate star counts on repositories, primarily targeting low-quality AI tools and executor software. A detection tool named phantomstars identifies these campaigns by analyzing account creation dates, activity patterns, and coordinated timing of star events. The fake engagement distorts the credibility signals developers rely on to evaluate and recommend software. No direct exploitation or vulnerability is described, but the manipulation impacts trust and decision-making in the open source ecosystem.
Reddit Discussion
Turns out: very visible. Yesterday's scan found 185 out of 185 engagers on a single repo were bots. Not 90%. Not "mostly suspicious". Every single one. The repo had zero legitimate stars.
What I built
phantomstars is a Python tool that runs daily via GitHub Actions (free, no servers):
- Scrapes GitHub Trending and searches for repos created in the last 7 days with sudden star spikes
- Pulls star and fork events from the last 24 hours per repo
- Bulk-fetches every engager's profile via the GraphQL API (account creation date, follower counts, repo history)
- Scores each account on a weighted model: account age (35%), profile completeness (30%), repo patterns (25%), activity history (10%)
- Detects coordinated campaigns using timestamp clustering and union-find: groups of 4+ suspicious accounts that engaged within a 3-hour window
- Files an issue directly on the targeted repo so the maintainer knows what's happening
Campaign IDs are deterministic SHA-256 fingerprints of the sorted member set, so the same group of bots gets the same ID across runs. You can track a farm across multiple days even as individual accounts get suspended.
What the pattern actually looks like
It's remarkably consistent. A fake engagement campaign in the raw data:
- 40-200 accounts, all created within the same 1-2 week window
- Zero original repositories, or only forks they never touched
- No bio, no location, no followers, no following
- All of them starring the same repo within a 90-minute window
- The target repo usually has a name implying it's a tool, hack, executor, or generator
Today's scan: 53 active campaigns across 3,560 accounts profiled. 798 classified as likely_fake. The repos being targeted are mostly low-quality AI tools and "executor" software that needs manufactured credibility fast.
Notifying the affected repo
When a repo hits a 40%+ fake engagement ratio or a campaign is detected, phantomstars opens an issue on that repo with the full suspect table: account logins, creation dates, composite scores, campaign membership. The maintainer sees it in their own issue tracker without having to find this project first.
Worth noting: a lot of these repos have issues disabled, which is a red flag on its own. Those get skipped silently.
Why I built this
Stars are how developers decide what to evaluate, what to depend on, what to recommend. When that signal is bought, it affects real decisions downstream. This started as curiosity about how measurable the problem was. The answer was more measurable than I expected.
It's part of broader research into AI slop distribution at JS Labs: https://labs.jamessawyer.co.uk/ai-slop-intelligence-dashboards/
The fake engagement problem and the AI content quality problem are really the same problem. Fake stars are the distribution layer that gets garbage in front of real users.
All open source. The data is append-only JSONL committed back to the repo after every run, queryable with jq.
Repo: https://github.com/tg12/phantomstars
Findings are probabilistic, false positives exist, the README explains the full scoring model. If your account shows up and you're a real person, there's a false positive process.
Questions welcome on the detection approach, GraphQL batching, or campaign ID stability.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The threat involves coordinated fake engagement campaigns on GitHub, where large groups of newly created bot accounts with minimal profile information star the same repository within a short time window. The phantomstars tool uses GitHub Actions and the GraphQL API to detect these campaigns by scoring accounts on factors such as account age, profile completeness, repository activity, and timing clusters. When a campaign is detected, an issue is automatically filed on the targeted repository to notify maintainers. This manipulation inflates star counts, misleading users about the quality and popularity of repositories, especially low-quality AI-related projects.
Potential Impact
The impact is primarily reputational and informational, as fake stars can mislead developers into trusting or depending on low-quality or potentially harmful software. This undermines the integrity of GitHub's social signals used for software evaluation. There is no indication of direct exploitation or compromise of systems. The problem affects the open source community's ability to discern genuine project popularity and quality.
Mitigation Recommendations
No official patch or fix is applicable as this is a manipulation of social signals rather than a software vulnerability. The phantomstars tool provides a detection and notification mechanism to alert repository maintainers of suspicious engagement. Repository maintainers can monitor issues filed by such tools and consider disabling stars or taking other repository-level actions if fake engagement is confirmed. Users should remain cautious about relying solely on star counts for evaluating repositories.
Technical Details
- Source Type
- Subreddit
- ThreatIntelligence+threatintel+websecurityresearch
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":32,"reasons":["external_link","established_author"],"isNewsworthy":true,"foundNewsworthy":[],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a13498fa5ae1af1aab69491
Added to database: 5/24/2026, 6:55:11 PM
Last enriched: 5/24/2026, 6:55:16 PM
Last updated: 5/24/2026, 10:09:41 PM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.