The editorial documents three repos (chokepoint-atlas, rift, reg-factory) that gained 4-6% in stars AFTER being publicly flagged as coordinated star-farms. It frames this as the second public failure of Trending moderation in three months, with no enforcement happening unless a major corporate security team escalates.
Argues the more interesting question isn't whether Trending is broken but why developers ever trusted it, given star velocity has dominated rankings since 2017 and star-farming has been a $0.01/star commodity service since 2019. The economics flipped when a 24-hour trending slot started driving 8,000-15,000 visits, making manipulation rational.
Climbed from 564 → 585 → 590 stars over the 48-hour window despite being flagged. The repo shows the classic farm fingerprint: throwaway accounts starring in batches, no fork or issue activity, README written for keyword extraction rather than humans.
Went from 511 → 533 → 545 stars after community flagging, with only 9 comments — the low engagement-to-star ratio is itself the smoking gun. Demonstrates that being publicly identified as suspicious does nothing to slow ranking momentum.
Grew 415 → 440 → 443 stars during the flag window. The 215 comments here likely reflect community pushback rather than genuine project interest, yet the Trending algorithm continues to reward the star velocity over the engagement signal.
Another trending-suspicious repo at 310 points with an unusually high 472 comments, suggesting community contention rather than organic adoption. Fits the broader pattern of throwaway-account-style repos surfacing on Trending without moderator intervention.
Reached 304 points with only 12 comments — the engagement-to-star imbalance characteristic of inorganic boosts. Its presence on Trending alongside the three flagged repos shows the problem isn't isolated to a single org.
Cites the prior npm typosquat incident under a stolen 'microsoft-' org prefix, which was only delisted after a Microsoft security team escalation. Argues nobody is escalating for the current three repos, so they will likely continue climbing — moderation is effectively outsourced to whoever has a big enough legal department.
Three repositories — `qiuqiubuchongle-cloud/chokepoint-atlas`, `anomalyco/rift`, and `tiantianGPU/reg-factory` — first surfaced on the GitHub Trending page roughly 48 hours ago with the now-familiar fingerprint of a coordinated star-farm campaign: throwaway accounts created in batches, near-simultaneous star events, no fork activity, no issue traffic, and READMEs that read like they were generated to game keyword extractors. The community flagged all three within hours. As of this morning, none have been delisted.
The star counts haven't just held — they've grown. chokepoint-atlas climbed from 564 to 585 to 590. rift went from 511 to 533 to 545. reg-factory: 415 → 440 → 443. That's a roughly 4-6% gain *after* being publicly identified as suspicious, after a 36-hour news cycle, after community moderators flagged the org accounts. The Trending algorithm is rewarding the manipulation it was supposed to detect.
This is the second public failure of GitHub's Trending moderation in three months, and the pattern is identical: coordinated star bursts on day one, ranking on day two, no enforcement by day three. The previous incident — the npm typosquat repos that ranked under a stolen `microsoft-` org prefix — was eventually delisted, but only after a Microsoft security team escalation. Nobody is escalating for these three.
The interesting question isn't "is Trending broken?" It is. The interesting question is why developers were ever using Trending as a discovery tool, given that star velocity has been the dominant ranking input since 2017 and star-farming has been a $0.01-per-star commodity service on Fiverr and Taobao since at least 2019.
The honest answer is that Trending was always a vibes-based discovery surface, and the vibes happened to work for a while because the cost of faking them was higher than the reward. That equation flipped quietly. A trending slot on GitHub for 24 hours now drives roughly 8,000-15,000 unique visitors and a measurable bump in npm/PyPI downloads if the repo links to a package — call it $2,000-$5,000 in attention value, conservatively. Buying 500 stars from a low-end star farm costs around $150-$200. The ROI is a 10x and the enforcement risk is approximately zero.
Meanwhile, the signals that *do* filter out manipulation are sitting in plain view on every repo page:
- Contributor count and concentration. Real projects have a long tail. The three flagged repos each have one contributor with one commit cluster. - Issue and PR throughput from non-author accounts. Manipulation campaigns don't pay people to file thoughtful bugs. chokepoint-atlas has zero non-author issue activity at 590 stars. Compare to any legit 500-star project — even a niche one — which will have 20-40 issues opened by strangers. - Dependent count. If the repo is a library, `Used by` is a near-perfect manipulation filter. You can buy stars; you can't fake the GitHub dependency graph at scale. - Commit cadence over time. Real projects have a heartbeat. Star-farm repos have a single push event and then go silent.
None of these are exotic signals. They're all on the repo's own page. Trending just chooses not to weight them.
The community has been working around this for years without quite admitting it. The serious discovery channels — `lobste.rs`, hand-curated newsletters like *Console* and *TLDR*, package-manager-native trending pages (`npm trends`, PyPI's `Trending` based on actual install counts, crates.io's `Recently Updated`), and topic-specific subreddits — all use signals that cost real money or real engineering effort to fake. Install counts require working CI and real users. Newsletter editors read the README. Lobsters' invite tree creates a social cost to manipulation. These aren't perfect, but they're not 48-hour walkovers either.
If you're using GitHub Trending as part of your weekly "what's new" routine, stop. Not because Trending is uniquely corrupt, but because it's now provably easier to game than to use as a signal, and the failure mode is silent — you don't get an alert when you're looking at a manipulated list. Concretely:
- Replace Trending with package-manager trending. `npm trends`, PyPI download stats, crates.io recent activity, and Go's pkg.go.dev popularity all weight actual usage, not stars. These are still gameable but the cost is an order of magnitude higher. - If you must use repo-level signals, weight `Used by` over stars. A repo with 200 stars and 1,500 dependents is real. A repo with 5,000 stars and zero dependents is — at best — a portfolio piece, at worst a campaign. - For "new and interesting" discovery, subscribe to 2-3 hand-curated sources rather than scanning Trending. The editorial filter is the whole point. *Console.dev*, *TLDR Dev*, *Hacker Newsletter*, and the per-language subreddits (r/golang, r/rust, /r/Python) all have humans in the loop. - If you're maintaining a project and feel pressure to chase Trending, know that the lift from a Trending slot is increasingly being arbitraged by spam farms. The real conversion path for a serious project is still: HN front page → newsletter pickup → package-manager organic discovery → conference talk. None of that runs through Trending.
This isn't a defense of the old Trending. It's an acknowledgment that the discovery problem moved years ago and most of us didn't update our habits.
GitHub will eventually delist these three repos — probably this week, probably after a journalist asks for comment. The interesting question is whether they'll weight non-star signals into the Trending ranking, or just keep playing whack-a-mole on individual campaigns. Based on the last three years of incidents, bet on whack-a-mole. The economics of moderation at GitHub's scale are brutal, and the people most invested in fixing Trending — serious open-source maintainers — are also the people who already stopped using it. Which means the only constituency loud enough to force a change is the one being scammed: the junior devs and managers who still trust the page. That's not a constituency GitHub historically optimizes for. Plan accordingly.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.