A CMU-led study found ~6 million suspected fake stars across 18,617 GitHub repositories — most promoting short-lived malware. Here is how the fraud works, how researchers detect it, and how to audit any repo's stargazers before you depend on it.

2026-07-13 · 7 min read · github / fake stars / supply chain security / open source