$1 for 10 Stars: ICSE Paper Exposes Fake GitHub Star Market

1美元买10颗星？顶会曝出GitHub假星灰产，热门仓库或藏木马

CMU researchers scanned GitHub events from July 2019 to Dec. 2024, flagging 6 million suspected fake stars. StarScout ran on about 20 TiB and found 18,617 repositories and 301,000 accounts. The supply-chain risk is concrete: GitHub deleted 90.42% of flagged repos, and about 30% of live samples were spam, phishing, or malware.

Why it matters: HKR-H/K/R all pass: the hook is concrete, the study provides numbers and a detection mechanism, and GitHub trust is a practitioner nerve. Not a model or platform release, so it stays below the 85 must-write band.