GitHub Trending is broken: how a phantom 283k-star repo got next to freeCodeCamp

What happened

GitHub Trending this morning surfaces three repos at the top of the daily slice: freeCodeCamp/freeCodeCamp (437.9k stars, the 12-year-old curriculum nonprofit), vinta/awesome-python (286.7k stars, the canonical opinionated list maintained since 2014), and — wedged between them — openclaw/openclaw at 283.1k stars, self-described as "Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞"

Two of these repos have a decade of receipts. The third has a lobster emoji and a star count larger than Kubernetes (112k), React (235k), and Linus's Linux mirror (188k) — and yet zero presence in the conversations where actual practitioners live: HN front-page archives, /r/MachineLearning, Hugging Face leaderboards, LangChain's integration matrix, or anyone's production incident postmortem.

This is the failure mode that the MSR 2024 paper *"4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Open Source Pollution"* (He et al.) anticipated. The authors flagged roughly 4.5 million stars across ~22,915 repositories as likely fraudulent, with the dominant tells being co-burst star clusters (hundreds of accounts starring within the same 30-second window), account-age skew (median creation date measured in days, not years), and zero downstream activity (no forks, no issues, no PRs, no dependent packages on npm/PyPI).

Why it matters

GitHub Trending is no longer a discovery surface a senior engineer can read without a filter. The page's ranking algorithm weights *recent star velocity*, which is exactly the variable that a $50 Fiverr campaign optimizes. Star-farming services have advertised pricing as low as $0.005 per star for the last 18 months — buying 100,000 stars for under $500 is now table stakes for any project chasing investor decks, acquisition leverage, or developer-tool ad placement.

The second-order damage is more interesting than the vanity-metric story. A growing fraction of the AI tooling stack — Cursor's "similar repos" recommendations, GitHub Copilot's project-context priming, Sourcegraph Cody's index, HN-front-page bots, every RSS-to-Twitter pipeline scraping `github.com/trending` on cron — treats star count as a trust signal. When the signal is poisoned upstream, every downstream consumer inherits the rot. Cursor will happily suggest you import patterns from a repo with 283k stars and 14 commits. An LLM tuned on GitHub README text learns that "the lobster way" is a credible AI assistant taxonomy.

The specific tells on the *openclaw* listing read like a checklist from the MSR paper: a single-line README pun, a category claim ("personal AI assistant") with no demo video, no benchmarks against ChatGPT/Claude/Gemini, no install instructions visible from the trending card, and a star count that places it above PyTorch's main repo (84k) despite no measurable mindshare in the ML community. Compare this to freeCodeCamp, which has 41,000+ contributors, 22 million unique learners, and a Stack Overflow Developer Survey footprint going back to 2017 — every star is downstream of a verifiable human activity.

The community has noticed. The most upvoted comment on a recent HN thread about a similar incident ("Why does GitHub Trending look like 2014 every day?") put it bluntly: *"Trending is now a recency-weighted leaderboard for the people most willing to pay for stars. The legitimate projects on the page are there in spite of the algorithm, not because of it."* GitHub's own staff have, off the record, acknowledged the problem in conference Q&As but the public response has been limited to occasional batch-removal sweeps — most recently a quiet purge in March 2025 that deleted ~12 million stars across ~58,000 accounts, with no public post-mortem.

What this means for your stack

Three practical adjustments, in increasing order of effort:

1. Stop treating star count as a trust signal in any automated pipeline. Replace it with a composite: weekly active forks, issue-close ratio over the last 90 days, number of distinct first-time contributors per quarter, and whether the project has any dependents on npm/PyPI/crates.io. If you're feeding repo metadata into an LLM prompt for recommendations, drop the star field entirely or weight it at <10% of the trust calculation. The GitHub REST API exposes `stargazers_url` with timestamps — a 30-line script can flag co-burst patterns by bucketing stars into 60-second windows and looking for the bimodal distribution that organic growth never produces.

2. Audit your own discovery layer. If your team uses Cursor, Copilot Workspace, Sourcegraph, or any "similar repos" feature, run a sanity check: pick five recommendations it surfaced this week and check whether each has more than 50 contributors and any package-registry dependents. The hit rate on that question is the real signal-to-noise ratio of your tooling — not the underlying model quality, but the data layer it's grounded in.

3. For the RSS / HN-bot / Twitter-pipeline operators in the audience: add a phantom-repo filter before the trending list reaches your output. The simplest version is `(stars / contributor_count) > 5000 AND issue_count < 50` — any repo that flags both heuristics is essentially a star/contributor anomaly that no legitimate fast-growth project produces. freeCodeCamp's ratio is ~10. openclaw's is, by inspection, somewhere north of 10,000.

Looking ahead

The underlying economics aren't reversing. As long as star count remains a free, public, gameable metric — and as long as it's the universal input to every developer-facing recommendation surface from Cursor to Hugging Face to JetBrains' marketplace ranker — the spiral the MSR authors described will continue. The fix isn't on GitHub's roadmap; the fix is in your filtering layer. The repos worth your attention this week are still the ones with twelve years of commit history and a contributor graph that looks like a real community — they're just not on the trending page anymore, and the trending page is no longer the right place to look.