Why GitHub Stars Are a Bad Way to Judge a Startup
Anyone can buy GitHub stars for as little as ten cents each, so I judge open-source startups by the people who actually use and improve their code. For as little as $10, you can buy 100 stars for a project on GitHub. A team of researchers led by Carnegie Mellon University found sellers charging between $0.10 and $2.00 per star , often promising delivery within days or even hours. After going…
Buying GitHub stars for as little as ten cents each is easy, so I assess open-source startups based on the people actively using and improving their code. Researchers from Carnegie Mellon University discovered sellers charging between $0.10 and $2.00 per star, often with promises of delivery within days or even hours. Going through GitHub's public activity records from July 2019 to December 2024, they found approximately 6 million suspected fake stars and 18,617 projects that engaged in fake star campaigns.
Named Alexander Kopylkov, I invest in technology companies, including developer tools. The study, presented in April 2026 at the International Conference on Software Engineering, underscores the need to reduce the importance of star counts when judging startups. It is crucial for anyone who writes code and funds it. A GitHub star is inexpensive to fake; one click is all it takes to add one, just like a bookmark to help you find a project later.
Over the years, a large star count became a quick way to imply that lots of people trust a project, making it worth faking.
Some startups buy stars because investors and managers examine them to judge whether a product is viable, contributing to the market that encourages this behavior. GitHub has policies prohibiting this, such as automated starring or following in its Acceptable Use Policies. However, fake star campaigns have become more common since 2024.
Bought stars don't last long, and many lead to malware. Most of the projects caught in these campaigns were removed from GitHub by January 2025, with about 90.42% removed within a year. Of the remaining projects, approximately 30% were spam or malware.
For developers, this is a safety concern. A project with thousands of stars may appear safe to download without a second look. For investors, a cheaply producible number says little about a real team. The most valuable insight from the study is that fake stars can bring a project some real attention, but only for less than two months, delivering only about five times the boost compared to real stars. In the long term, buying fake stars negatively impacts the number of real stars a project accumulates.
The authors conclude that star counts should not be used as the sole basis for high-stakes decisions, such as investing money. When assessing an open-source startup, I look for signs of real dependability on the code. Questions like who outside the founding team contributes improvements and continues to do so, how quickly the team responds to user problems, which companies run the project within their products, and whether they notice if it breaks, prove harder to fake.
A founder who can name ten companies using the project and explain how each found it provides useful insights that can be verified through phone calls.
The research advises founders to focus on building a real community around the code. Steady usage proves more reliable than a single number on a slide. The paper cites Donald T. Campbell's observation from 1979: the more a number influences decisions, the greater the pressure to corrupt it. Stars have become a perfect example. To attract investors, developers should prioritize the people using their code. Investors who prioritize these factors are more likely to be worth working with.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
