CLI that spots fake GitHub stars, risky dependencies and licence traps
When I came across a study that traced 4.5 million fake GitHub stars, it confirmed a suspicion I’d had for a while: stars are noisy. The issue is they’re visible, they’re persuasive, and they still shape hiring decisions, VC term sheets, and dependency choices—but they say very little about actual quality. I wrote StarGuard to put that number in perspective based on my own methodology inspired with what they did and to fold a broader supply-chain check into one command-line run. It starts with the simplest raw input: every starred_at timestamp GitHub will give. It applies a…
In plain words
StarGuard is a command-line tool that analyzes GitHub repositories to detect artificially inflated star counts and identify supply-chain risks. It examines star timestamps to find suspicious spikes, then evaluates the accounts behind those spikes—checking user age, follower counts, contribution history, and profile details—to calculate a Fake Star Index ranging from organic to synthetic. Designed for developers, hiring teams, and organizations making dependency decisions, it helps distinguish genuine project quality from manipulated metrics in a single command.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
When I came across a study that traced 4.5 million fake GitHub stars, it confirmed a suspicion I’d had for a while: stars are noisy. The issue is they’re visible, they’re persuasive, and they still shape hiring decisions, VC term sheets, and dependency choices—but they say very little about actual quality. I wrote StarGuard to put that number in perspective based on my own methodology inspired with what they did and to fold a broader supply-chain check into one command-line run. It starts with the simplest raw input: every starred_at timestamp GitHub will give. It applies a median-absolute-deviation test to locate sudden bursts. For each spike, StarGuard pulls a random sample of the accounts behind it and asks: how old is the user? Any followers? Any contribution history? Still using the default avatar? From that, it computes a Fake Star Index, between 0 (organic) and 1 (fully synthetic). But inflated stars are just one issue. In parallel, StarGuard parses dependency manifests or SBOMs and flags common risk signs: unpinned versions, direct Git URLs, lookalike package names. It also scans licences—AGPL sneaking into a repo claiming MIT, or other inconsistencies that can turn into compliance headaches. It checks contributor patterns too. If 90% of commits come from one person who hasn’t pushed in months, that’s flagged. It skims for obvious code red flags: eval calls, minified blobs, sketchy install scripts—because sometimes the problem is hiding in plain sight. All of this feeds into a weighted scoring model. The final Trust Score (0–100) reflects repo health at a glance, with direct penalties for fake-star behaviour, so a pretty README badge can’t hide inorganic hype. I added for the fun of it it generating a cool little badge for the trust score lol. Under the hood, its all uses, heuristics, and a lot of GitHub API paging. Run it on any public repo with: python starguard.py owner/repo --format markdown It works without a token, but you’ll hit rate limits sooner. Please provide any feedback you can.
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, May 2025
the whole month →
- C9
Life & fun · 2025 · felixrieseberg.github.io
