I Bought GitHub Stars for €28
I wanted to see how easily you could fake an open-source project’s popularity. So I bought 125 stars, tested whether they looked legitimate, and discovered something ridiculous.
Originally published on The Guild’s blog on June 1, 2023, reviewed by Aleksandra Sikora. The prices, sellers and detection results below are from that experiment, not from today.
We’ve all done it.
You’re choosing between two open-source libraries. One has 500 stars, the other has 20,000.
Which one are you more likely to trust?
Exactly.
GitHub stars have become a weird form of social proof. We know they don’t necessarily mean a project is good, but we still use them to decide which projects deserve our attention.
So I got curious.
What if you could just buy them?
Turns out, you can.
And they’re surprisingly cheap.
Buying GitHub stars
I found several websites selling GitHub stars, just like the ones selling Instagram followers.
Naturally, I had to try it.
I created a second identity, went by “Boogeyman,” and bought stars from two different services.
One offered cheap stars. The other offered something called premium stars.
Yes, apparently GitHub stars have luxury tiers now.
Here’s what I paid:
| Package | Stars purchased | Total cost | Cost per star |
|---|---|---|---|
| Premium | 25 | €19.90 | €0.80 |
| Cheap | 100 | $9.00 (about €8.19) | €0.08 |
For about €28, I bought 125 GitHub stars.
That’s less than the price of a decent dinner.
And the difference between the two packages was fascinating.
The premium stars
The premium package cost about €20 for 25 stars.
Six hours after placing my order, they appeared.
And honestly? They looked pretty convincing.
The accounts had profile pictures, employment histories, repositories, and contributions to open-source projects.
Some had been around for more than a year.
If you casually checked who starred the repository, you probably wouldn’t think much of it.
These weren’t obviously empty accounts created five minutes ago.
Someone had put actual effort into making them look real.
Which raises a pretty funny question:
How much work goes into maintaining a fake GitHub account so someone can sell its stars for €0.80 each?
The cheap stars
Then there was the bargain bin.
$9 for 100 stars, about €8.19.
That’s roughly eight cents per star.
The receipt showed order number #57189, which certainly made me wonder how many orders the service had processed.
Unlike the premium accounts, these were painfully obvious.
Most were brand-new, with no meaningful profile information, repositories, or contributions.
But they did the job.
My repository suddenly had 100 additional stars.
At least temporarily.
A month later, every single one was gone.
The accounts had disappeared, apparently caught by GitHub’s anti-abuse systems.
And here’s my favorite part.
The seller offered to replace them for free.
Apparently, fake GitHub stars come with customer support.
Can you detect fake stars?
Now I was curious about something else.
If premium fake accounts look legitimate, can automated tools actually distinguish them from real users?
I found a tool called Astronomer, which analyzed a repository’s stargazers and assigned a trust score based on signals like account age, contributions, pull requests, issues, and code reviews.
So I tested three repositories:
- One with premium purchased stars.
- One with cheap purchased stars.
- One with legitimate stars, as a control.
Here were the results:
| Repository | Trust score |
|---|---|
| Legitimate stars | A |
| Premium fake stars | B |
| Cheap fake stars | E |
The cheap stars were immediately suspicious.
No surprise there.
But the premium ones?
They scored a B.
A repository containing purchased stars managed to get a fairly respectable trust score.
For context, the tool looked at signals like these:
| Metric | Premium test | Cheap test | Legitimate control |
|---|---|---|---|
| Average account age | 1,619 days | 36 days | 2,538 days |
| Average authored commits | 259 | 87 | 1,300 |
| Average pull requests | 36 | 3 | 101 |
| Average code reviews | 6 | 1 | 69 |
| Overall trust | B | E | A |
These were repository-level results, not isolated measurements of only the purchased accounts. The premium test included existing stargazers, which matters when interpreting its score.
Premium stars: B
Fetching contributions for 69 users up to year 2013
Building trust report...ok
Averages Score Trust
-------- ----- -----
Weighted contributions: 18268 B
Private contributions: 370 A
Created issues: 91 A
Commits authored: 259 C
Repositories: 41 A
Pull requests: 36 A
Code reviews: 6 C
Account age (days): 1619 B
5th percentile: 12 A
10th percentile: 16 C
15th percentile: 20 D
20th percentile: 20 E
25th percentile: 24 E
30th percentile: 24 E
35th percentile: 24 E
40th percentile: 28 E
45th percentile: 332 D
50th percentile: 1106 B
55th percentile: 1692 B
60th percentile: 2770 A
65th percentile: 6422 A
70th percentile: 10958 A
75th percentile: 15598 A
80th percentile: 26596 A
85th percentile: 34116 A
90th percentile: 69967 A
95th percentile: 85147 A
----------------------------------------------------------
Overall trust: B
Cheap stars: E
Fetching contributions for 24 users up to year 2013
Building trust report...ok
Averages Score Trust
-------- ----- -----
Weighted contributions: 856 E
Private contributions: 21 E
Created issues: 3 E
Commits authored: 87 E
Repositories: 4 E
Pull requests: 3 E
Code reviews: 1 E
Account age (days): 36 E
5th percentile: 3 D
10th percentile: 3 E
15th percentile: 3 E
20th percentile: 3 E
25th percentile: 3 E
30th percentile: 3 E
35th percentile: 3 E
40th percentile: 3 E
45th percentile: 3 E
50th percentile: 3 E
55th percentile: 3 E
60th percentile: 3 E
65th percentile: 3 E
70th percentile: 3 E
75th percentile: 3 E
80th percentile: 4 E
85th percentile: 4 E
90th percentile: 4 E
95th percentile: 4 E
----------------------------------------------------------
Overall trust: E
Legitimate control: A
Fetching contributions for 139 users up to year 2013
Building trust report...ok
Averages Score Trust
-------- ----- -----
Weighted contributions: 118821 A
Private contributions: 2407 A
Created issues: 72 A
Commits authored: 1300 A
Repositories: 74 A
Pull requests: 101 A
Code reviews: 69 A
Account age (days): 2538 A
5th percentile: 145 A
10th percentile: 711 A
15th percentile: 2726 A
20th percentile: 4144 A
25th percentile: 8535 A
30th percentile: 13650 A
35th percentile: 20728 A
40th percentile: 23322 A
45th percentile: 28244 A
50th percentile: 37636 A
55th percentile: 42536 A
60th percentile: 55776 A
65th percentile: 78956 A
70th percentile: 93676 A
75th percentile: 129164 A
80th percentile: 194463 A
85th percentile: 231380 A
90th percentile: 286798 A
95th percentile: 559934 A
----------------------------------------------------------
Overall trust: A
Still, the result was interesting.
The premium package was substantially harder to distinguish from ordinary GitHub activity than the cheap one.
And it made me wonder.
If €0.80 gets you a B, how much does an A cost?
So, are GitHub stars worthless?
Not exactly.
Stars are useful for discovering projects and getting a rough sense of community interest.
But they’re a terrible substitute for actually evaluating software.
A repository with 30,000 stars might be abandoned.
A repository with 300 stars might be actively maintained, well-designed, and exactly what your project needs.
And as this experiment demonstrated, some of those stars might not even represent genuine interest.
When I’m evaluating an open-source project, I care much more about a few things:
- Maintenance: Is anyone still working on it?
- Responsiveness: Do maintainers actually respond to issues and pull requests?
- Contributors: Is development sustained, or did everyone disappear two years ago?
- Code quality: Can I understand the code, and would I be comfortable depending on it?
- Community: Are real people using it, contributing to it, and discussing problems?
Stars can help you find a project.
They can’t tell you whether you should trust it.
The funniest part
I spent about €28 and a few hours experimenting with something that developers regularly use as a credibility signal.
For that money, I could make an obscure repository look noticeably more popular.
And if I’d only bought premium stars, someone casually inspecting the accounts might never have noticed.
That’s pretty ridiculous.
I’m not suggesting anyone should buy GitHub stars. It misrepresents a project’s popularity and undermines the trust that makes open source work.
But I am suggesting we stop treating a number beside a little star icon as evidence of engineering quality.
The next time you’re choosing between two libraries, maybe spend five minutes looking at the code instead of counting the stars.