422, 421, 421: GitHub Trending's botnet tell is hiding in plain sight

What happened

Three repositories surfaced on GitHub Trending within hours of each other: `larajuniorlara/Claude-Design-Studio` (422 stars), `sofian160616/Delta-Inject-Workstation` (421 stars), and `bollahouse/office-2024-pro-integration-suite` (421 stars). Different owners, different audiences — UI designers chasing a Claude-branded plugin suite, Roblox kids chasing a script executor, Office users chasing a cracked installer. Same template: emoji-laden README, '2026' in the title, 'Free Download' in the description, and a release link pointing to an external installer.

The tell isn't the spam — it's the arithmetic. Three independent, organically discovered repositories on three different topics do not converge on star counts of 422, 421, and 421 by accident. That's a star-farm batch job with a single configured target — roughly 420 stars, enough to clear the Trending threshold for low-competition language buckets — fired against three repos in parallel.

We've covered the GitHub Trending spam problem before, usually as a 'platform hygiene' story. This is a different beast. The clustering of star counts, the near-identical README templates, and the synchronized timing point to a single operator (or a single rented service) running coordinated drops. The repos themselves are disposable; the infrastructure behind them is not.

Why it matters

The interesting question isn't 'why does GitHub allow this' — it's 'what's the unit economics.' Star-farming services advertise on Telegram and a handful of grey-market forums at roughly $0.01–0.03 per star from aged-but-low-reputation accounts. Four hundred stars costs the operator somewhere between $4 and $12 — less than a single Google Ads click for 'free office download' — and buys placement on a page that GitHub itself promotes to millions of developers daily.

The payloads follow a depressingly stable pattern. Security researchers at Checkmarx, Phylum, and ReversingLabs have documented this exact lure family across 2024 and 2025: the 'installer' is a password-protected archive (password-protected to defeat VirusTotal scanning on the link itself), unpacking to a .NET or AutoIt loader, which in turn pulls down an info-stealer — most commonly RedLine, Lumma C2, or Vidar. The stealers exfiltrate browser-saved credentials, crypto wallet files, Discord tokens, and session cookies. The cookies are the prize: a stolen GitHub session cookie buys the operator a fresh account to host the next round of repos, which closes the loop.

This is why the spam never stops: each successful infection produces both immediate financial yield (credentials sold on Russian Market, Genesis, or 2easy) and the infrastructure for the next campaign. The 'GitHub Trending is broken' framing misses the point. Trending isn't broken in the sense of malfunctioning. It's working exactly as designed — a velocity-weighted leaderboard that rewards rapid star accumulation — and that design happens to be perfectly aligned with what a credential-stealing operation needs.

The 'Claude-Design-Studio' variant is the new wrinkle worth flagging. Earlier campaigns rode the names of established consumer brands (Office, Photoshop, AutoCAD). The shift to Claude — and the parallel proliferation of 'Cursor 2026 Pro Crack' and 'ChatGPT Plus Activator' repos through the latter half of 2025 — signals that the operators have noticed where the new SaaS spend is going. Developers paying $20/month for Cursor or $200 for Claude Max are exactly the demographic with browser-saved credentials worth stealing. The lure has moved up-market with the audience.

What this means for your stack

First, the obvious: do not click 'Releases' on a GitHub repo you found via Trending unless you can independently verify the publisher. The Trending page itself is not a trust signal. If anything, a repo that hit Trending in under 24 hours with no commit history before this week and a README full of fire emojis is a stronger negative signal than no Trending presence at all.

Second, audit what your engineers reach for. Internal telemetry from a few security teams I've talked to suggests the most common infection path isn't the engineer who knows they're pirating software — it's the engineer who searches '[tool] free download' and clicks the top result without parsing the URL. GitHub repos win that search because Google trusts the domain. If your endpoint policy still treats `github.com/*/releases/download/*` as inherently safe, you have a gap that two clicks closes.

Third, if you maintain dependency scanners or supply-chain tooling, the related — and more dangerous — vector is the typo-squatted package, not the binary. The same operators run parallel campaigns on npm and PyPI: `clade-sdk`, `anthropc`, `roblox-executor-py`, with post-install scripts that pull the same stealer families. The repos on Trending are loud and obvious. The packages are quiet and live inside your build.

Looking ahead

GitHub has the data to kill this — star velocity from low-reputation accounts, README template similarity across owners, the inevitable correlation in IP space of the staring accounts. The fact that it hasn't, after years of public reporting, suggests either that the false-positive cost on legitimate viral repos is judged too high, or that Trending is a low enough priority surface to coast on. Either way, treat Trending as a curiosity feed, not a discovery channel. The signal-to-noise has been trending the wrong direction for two years, and the operators have figured out that the algorithm itself is the product.