openclaw has 283k stars. GitHub stars are officially cooked.

What happened

Today's GitHub Trending top three, sorted by stars: sindresorhus/awesome at 444.0k, freeCodeCamp/freeCodeCamp at 437.9k, and — sitting one slot below the most-curated meta-list on the platform — openclaw/openclaw at 283.1k stars, described in its own README as "Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞"

283,100 stars puts openclaw above React (~230k), above Vue (~210k), and within shouting distance of the Linux kernel mirror. If you have never heard of it, that is not a gap in your reading list. The name "openclaw" historically belonged to a 2014 C++ reimplementation of the 1997 Monolith platformer *Captain Claw* — a hobby project with low four-digit stars. The repo currently squatting that namespace shares nothing with it beyond the URL.

The other two slots aren't much better as developer-tool signals. sindresorhus/awesome is a list of awesome lists. freeCodeCamp is a learning platform, not a library you import. Two of the top three trending repositories on the world's largest code host today contain zero code anyone is going to deploy.

Why it matters

GitHub stars have done a lot of work in this industry. They gate funding decisions at YC. They justify the "production-ready" claim on a thousand landing pages. They show up in npm package READMEs as the headline trust signal. They are, for better or worse, the closest thing open source has to a market cap.

The mechanics underneath that signal are now visibly broken. Stars are non-transferable in name but fully transferable in practice: rename a repo, transfer it to a new owner, rewrite the README, and the star count comes along for the ride. GitHub does not surface rename history on the repo card. Trending does not weight stars by recency or by activity on the current codebase. A repo that earned 280k stars over a decade of being something else can be turned into something completely new tomorrow, and the leaderboard will dutifully promote it.

This is the same supply-chain attack surface that the autocomplete-squatting story from last week pointed at — repos named `Codex-5.5-codex-instruct-5.5`, `dd`, `clash` farmed for agent autocomplete — but at the other end of the funnel. The autocomplete attack targets agents that don't read; the star-transfer attack targets humans who read only one number. A senior engineer evaluating a dependency in thirty seconds checks stars, last-commit date, and open-issue count. Two of those three travel with the namespace. The third can be faked with a single rebase.

The community has been quietly calling this for years. Antirez (Redis) has pointed out that stars correlate with marketing budget, not maintenance quality. Sindre Sorhus himself — owner of the #1 trending repo today — has written that the awesome-list ecosystem is closer to SEO than to engineering. The signal isn't degraded at the edges; the median GitHub star in 2026 carries roughly the same information as a LinkedIn endorsement.

What this means for your stack

If you are using stars to gate dependencies, stop. Use commits-in-the-last-90-days, distinct-committer-count, and issue-response-median instead — all available through the GitHub GraphQL API in one query. The `ossf/scorecard` project from the OpenSSF runs the same idea with a published rubric; pipe it into your CI on any new dependency and you will catch most of what stars used to flag.

For your own repos: if you depend on GitHub Trending or star count for distribution, you are now competing against a category of actor who can manufacture both. The defensive move is to publish your real numbers — downloads-per-week from the registry, build-success rate, p95 install time — somewhere your stars cannot. README badges from npm, PyPI, and crates.io are harder to launder than a star count.

For agent-driven workflows specifically: if your coding agent reaches for repositories by stars-and-name, you have just inherited every star-transfer attack that has ever happened on the platform. Add an allowlist. Pin to specific commit SHAs, not tags, and never to repository names alone. The agent supply-chain story we have been writing about all week is the same story; the openclaw repo is just the screenshot.

Looking ahead

GitHub has the data to fix this in a single sprint: show rename history on the repo card, decay stars on namespace transfer, and weight Trending by activity-on-current-tree rather than total accumulated stars. Whether they will is a different question — Trending is a growth surface for Microsoft now, and a leaderboard cluttered with lists and renamed hobby projects still drives the same DAU number as a clean one. Until that changes, the practical answer is to treat the star count the way you treat a self-reported resume metric: useful only when corroborated, and never on its own.