The project README says that from June 30, 2026, the stargazer list is limited to repository admins and collaborators; it also says the REST endpoint returns 404 for repositories with stars and the GraphQL stargazers connection is empty for others.
The thesis is: Starsift turns a missing direct list into a sampled comparison problem, not a definitive authenticity test. It assembles candidate accounts from repository event feeds, GH Archive, and fork owners, then compares them with accounts active in the same hours on other repositories. The README’s example from a published suspected-fake-stars dataset reports that 34% of the sampled accounts had been deleted or suspended, against 10% in a time-matched control; it also reports shared stars across several small repositories. These are the project’s reported observations, not an independent validation of the tool.
The mechanism is temporal matching: a control group helps distinguish suspicious account patterns from ordinary characteristics of GitHub users. That is potentially more informative than treating young accounts or a sudden star spike alone as proof.
Thesis
Starsift turns a missing direct list into a sampled comparison problem, not a definitive authenticity test.
Observed facts
The README says that from June 30, 2026, stargazer lists are limited to repository admins and collaborators; it says the REST endpoint returns 404 and the GraphQL connection is empty for others.
1A README example from a published suspected-fake-stars dataset reports 34% of sampled accounts deleted or suspended, versus 10% in a time-matched control group.
1Starsift draws data from repository event feeds, GH Archive, and fork owners, then compares accounts active in the same hours on other repositories.
1
Mechanism
The mechanism is temporal matching: a control group helps distinguish suspicious account patterns from ordinary characteristics of GitHub users.
Why now
GitHub’s public stargazer identities are no longer available to ordinary users, while star counts remain a widely used proxy for project popularity.
Implications
Popularity audits can continue through public traces, but their conclusions should be framed as risk signals requiring corroboration.
The control-group approach is more informative than treating account age or a star spike alone as proof.
Evidence boundary
only sampled windows are checked, and GitHub hides activity from accounts it has flagged.
Watch conditions
whether independent users reproduce its findings across repositories.
whether the method remains usable as GitHub’s event data access changes.