Making millions of dollars on fake GitHub stars
TL;DR
GitHub stars have become a cheap growth hack with expensive consequences — Theo highlights reporting and peer-reviewed research suggesting over 6 million suspected fake stars across 18,600 repos, with stars purchasable for as little as 6 cents each while seed rounds can unlock $1 million to $10 million.
The fraud isn’t just bots clicking stars — it’s a full shadow market — he walks through vendors, Fiverr gigs, star-exchange sites, fake contribution-history tools, $5,000 aged GitHub profiles, and even services offering APIs and replacement guarantees for “non-drop” stars.
AI and crypto repos are where the manipulation looks worst — citing Star Scout and Awesome Agents, Theo points to projects like Union Labs, Raga AI, OpenIFM, and Freedomain as showing suspicious signals such as 50%+ zero-follower stargazers, ghost accounts, and abnormally low fork-to-star and watcher-to-star ratios.
VCs do look at stars, but Theo argues they’re often a weak checkbox, not the whole investment case — he quotes Redpoint’s benchmarks of 2,850 median stars at seed and 4,980 at Series A, then pushes back on examples like Lovable and Browser Use, saying their fundraising was driven far more by revenue, hype, and market demand than raw GitHub stars.
GitHub’s real failure, in Theo’s view, is that it built social signals without social-system defenses — he compares GitHub’s nonexistent moderation and anti-abuse tooling to Twitch’s deeply developed mod stack and says that without weighted popularity metrics, reputation systems, or transparent enforcement, the problem will get worse.
Theo broadens the point beyond GitHub: fake optics are infecting the whole creator-tech ecosystem — he connects fake stars to inflated npm downloads, botted X engagement, shady sponsor outreach from companies like Blackbox AI and Higgsfield, and suspicious YouTube view counts, framing it all as the same scam of buying credibility to sell the appearance of traction.
The Breakdown
Why fake stars are suddenly a real threat
Theo opens with the bigger loss: GitHub stars used to be a rough trust signal for developers, investors, and anyone peeking into open source from the outside. Now that stars influence tooling choices, discovery, and VC attention, he says the whole thing has become a textbook Goodhart’s Law situation — once the metric became the target, it stopped being useful.
Normies hit GitHub, and stars got even more valuable
He riffs on screenshots of non-developers raging that GitHub should just have a giant red download button, using that as proof the audience for repos is way broader now. In Theo’s telling, tools like OpenClaw and Claude Code breaking out beyond devs means GitHub popularity can signal mainstream momentum — which is exactly why VCs who “also fall under the where’s the download button camp” lean so hard on stars.
The 6 million fake-star investigation gets very real, very fast
Theo then dives into the Awesome Agents report and the Star Scout research from Carnegie Mellon, NC State, and Socket: 20TB of metadata, 6.7 billion events, 326 million stars, and roughly 6 million suspected fake stars from 2019 to 2024. The part that really lands for him is the acceleration: by July 2024, more than 16% of repos with 50+ stars were involved in fake-star campaigns, and 78 manipulated repos still made GitHub Trending.
There’s an entire industry selling GitHub credibility
This section is where Theo’s disbelief turns into disgust. He lists the whole menu: cheap disposable stars, pricier aged accounts, Fiverr gigs, star-exchange platforms, tools to forge contribution graphs, Telegram accounts with five-year histories for around $5,000, and WeChat groups generating millions annually — all to make repos look real enough to fool ranking systems and outsiders.
Theo’s bigger indictment: GitHub can host code, but it can’t run a community
From there he pivots into a long-standing frustration with GitHub itself. Drawing on his Twitch background, he compares Twitch’s moderation stack — shield mode, slow mode, follower-only, automod controls, customizable mod views — with GitHub’s near-total lack of tools for repo maintainers to limit abuse, moderate issues, or manage spam waves, and says it’s no surprise star fraud thrives on a platform with so little community infrastructure.
What manipulated repos actually look like in the data
Theo walks through the heuristics that stood out in the analysis: lots of zero-repo and zero-follower stargazers, ghost accounts with no bio or activity, low fork-to-star ratios, and almost nonexistent watcher-to-star ratios. He contrasts healthy projects like Flask and LangChain with blockchain-heavy examples like Union Labs and Freedomain, then lingers on AI names like Raga AI and OpenIFM as looking rough, while saying Hermes Agent feels comparatively organic and that his own bias there seems to check out.
Do stars really turn into funding? Yes — but Theo thinks the article overstates it
He agrees stars matter because investors openly scrape GitHub and Redpoint has published benchmarks, but he strongly objects to examples like Lovable, Browser Use, and other breakout companies being framed as simple star-to-funding pipelines. Theo’s insider angle is the key here: he says he was personally involved around some of these companies, invested in Browser Use and Lovable, passed on others, and claims nobody was making decisions based on “fucking GitHub stars” alone.
The scam pattern goes way beyond GitHub — and Theo is ready to name names
In the back half, he connects fake stars to inflated npm downloads, bot-amplified X replies, shady sponsor pitches from Blackbox AI and Higgsfield, and suspiciously botted YouTube channels with million-view videos and almost no engagement. He gets unusually personal here, saying he’s turned down seven-figure sponsor money rather than sell scams to his audience, and ends by calling for FTC and SEC scrutiny — not just for fake GitHub traction, but for everyone in tech media and startups buying the optics of success.