# research-backed writing on dependency evaluation, fake stars, and supply chain security

• How to Evaluate an Open-Source Library Before You Depend on It: A Practical Checklist

  Stars and download counts are the weakest signals a repository emits. Here is a six-part checklist — activity, maintenance, community, documentation, security, and real adoption — for evaluating any GitHub dependency before it lands in your lockfile.

  2026-07-14 · 8 min read · dependency evaluation / open source / github / developer tools

• Bus Factor: The Dependency Risk Hiding Behind Healthy-Looking Repos

  A repository can have thousands of stars, green CI, and fast releases while every meaningful commit comes from one exhausted volunteer. What the bus factor measures, why xz-utils made it a security problem, and how to check it for any GitHub dependency.

  2026-07-14 · 7 min read · bus factor / open source / supply chain security / maintainers

• Is That GitHub Repo Abandoned? Nine Signals of an Unmaintained Dependency

  Repositories rarely announce their own death — they just stop answering. Nine public signals that separate an abandoned GitHub project from a stable, finished one, and how to check them before the dependency ships in your product.

  2026-07-14 · 7 min read · github / abandoned projects / dependency evaluation / maintenance

• From event-stream to xz: Four Supply Chain Attacks and the Signals They Left Behind

  event-stream, ua-parser-js, node-ipc, xz-utils — four famous open-source supply chain attacks, four different entry points, and the public warning signs each one left in plain sight before it detonated.

  2026-07-14 · 9 min read · supply chain security / open source / malware / case studies

• Six Million Fake GitHub Stars: Why Star Counts Lie and How to Audit Them

  A CMU-led study found ~6 million suspected fake stars across 18,617 GitHub repositories — most promoting short-lived malware. Here is how the fraud works, how researchers detect it, and how to audit any repo's stargazers before you depend on it.

  2026-07-13 · 7 min read · github / fake stars / supply chain security / open source