Check C3 · provenance family · severity HIGH · automatic · one of the 22 checks
The question this check asks: does this repository's popularity match its provenance? Not how many stars — whether the number makes sense against how old the account is and how old the repository is.
Stars are a purchased commodity. CMU's ICSE 2026 study identified around 6 million suspected fake stars on GitHub, and the going rate is roughly half a yuan each. A star count is therefore not evidence of anything except that someone wanted a star count. What is hard to fake is the thing stars are supposed to stand for — a maintainer with years of unrelated public history, and a project that grew at the speed projects grow.
The 2025 phase of the FakeGit campaign used bought stars to make lookalike repositories rank; this check was written for that pattern. The 2026 phase mostly did not bother — Island's examples carried between 5 and 90 stars against 67,000 on the project they impersonated — and this page says so below, because a check should be honest about which half of a campaign it was built for.
C3 produces two findings from the repository API, and they are weighted very differently.
Traction mismatch. More than 200 stars on an account under a year old fires at severity HIGH and costs 20 points: the verdict reads REVIEW, the download is held, and the finding says “N★ on an account Nd old — check for purchased stars”. Both thresholds are policy parameters. The evidence note in the scoring table:
“bought-star pattern; rare on controls”
Star velocity. Stars arriving faster than twenty a day over the repository's life, on a repository with more than 300 stars, fires at severity MEDIUM and costs 4 points — and the default personal policy does not act on it. It is on the board as “N★ over Nd — implausible organic rate”; the download proceeds. The scoring table explains why it is worth so little:
“24/80 hot legit repos trip this — noise-grade”
Neither finding blocks on its own. A fresh account with a sudden thousand stars is a BLOCK because of the account age, with this check as the corroboration.
Hot projects. In our Phase 0 controls, 24 of the 80 most popular repositories on GitHub tripped the velocity finding, because a project that lands on the front page of Hacker News gains far more than twenty stars a day and there is nothing suspicious about it. That measurement is the reason velocity is 4 points and not acted on by default. Traction mismatch was rare on the controls, but the case it cannot distinguish is a genuine first project by a new developer that goes viral — the board shows the star count and the account's age in days, and the decision is yours.
Fakes that do not buy stars. The 2026 FakeGit repositories carried a few dozen stars each; in our measurement of all 7,648 of them, none of the repositories the provenance checks missed had more than 200 stars, so there was nothing for traction mismatch to catch. The fresh-account half of that campaign fell to the account-age check, not to this one. Stars bought slowly on an old account pass both thresholds by construction. And the check counts stars; it does not examine who starred — the age and history of the stargazer accounts, which is how dedicated star-fraud tools work — so a purchase that stays under the thresholds is invisible to it.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: compare the star count with the repository's creation date on its page, and with the owner's Joined date on their profile. Hundreds of stars on a month-old account is the question; the answer is on the stargazers page — click the star count and look at a dozen of the accounts. With the GitHub CLI:
gh api repos/OWNER/REPO --jq '{stargazers_count, created_at}'
gh api 'repos/OWNER/REPO/stargazers?per_page=30' --jq '.[].login'Then open a few of those accounts. Stargazers created in the same week, with no repositories and no activity, are the purchase.
Are a lot of stars proof that a repository is safe? No. CMU's ICSE 2026 study identified around 6 million suspected fake stars, sold for roughly half a yuan each. Stars are a purchased commodity; what is hard to buy is years of unrelated history on the same account. That is why RepoGates weighs account age far more than stars, and treats stars mainly as a contradiction to look for.
My project went viral this week — does that count against it? Barely. Stars arriving faster than twenty a day fire the velocity finding, which costs 4 points and which the default policy does not act on — 24 of the 80 most popular repositories in our controls trip it. Only stars on a young account — more than 200 on an account under a year old — cost 20 points and hold the download for a look.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C1 Owner account age — the signal this one corroborates · C2 Repository age — the other half of the velocity ratio · C4 Fork and lookalike — what the bought stars are usually promoting.
Add RepoGates to Chrome Pricing
Numbers on this page: CMU, ICSE 2026 (suspected fake stars); Island, July 2026 (star counts on campaign repositories); Phase 0 measurement of 2026-08-14 (80 popular controls, 7,648 campaign slugs); weights from the product's scoring table.