We Scanned 100 AI Repos on GitHub. Here's What We Found.
We Scanned 100 AI Repos on GitHub. Here's What We Found. A drone firmware project with 3× more stars than the real one. A crypto protocol that turned GitHub into a points farm. A README with 6,289 stars and 2 commits. As a developer turned architect, I used to treat GitHub stars as a proxy for trust. More stars meant more legitimate, fewer reasons to question before cloning. That instinct got me thinking. So I built TrustStar , audited hundreds of repos, and found that some people had figured out that instinct before me. Here's what the data showed. Case 1: The Airdrop Farm (QuipNetwork) 🔴 DANGEROUS Repository Stars Forks Fork/Star ratio hashsigs-py 11,200 9 0.0008 hashsigs-rs 11,300 42 0.0037 hashsigs-ts 11,300 31 0.0027 hashsigs-solidity 11,300 33 0.003 quip-protocol 11,645 159 0.014 ethereum-sdk ~11,400 72 0.006 cpp-sdk ~11,300 44 0.004 Six repos in completely different languages (Python, Rust, TypeScript, Solidity, C++) all converging on exactly ~11,300 stars. Projects with genuinely different audiences don't do that. The mechanism was on their own website: "Each GitHub repo star earns 5 QUIP points." QuipNetwork launched a crypto airdrop in early February 2026. Users who wanted QUIP tokens starred every repo in the organization. 11,000 stars in 48 hours, after five months of zero activity. The tell: dashboard.quip.network has 2 stars. nodes.quip.network has 2 stars. The repos they forgot to include in the airdrop show the real numbers. This is the first documented instance of a crypto airdrop using GitHub as a gamification layer. These aren't bots. They're real users who just wanted tokens. Case 2: The Typosquat (ShlkOfTheRa/scarab-osd) 🔴 DANGEROUS. The most dangerous case in this dataset. ShikOfTheRa/scarab-osd is a legitimate drone flight controller firmware project. 468 stars, built over 10 years. ShlkOfTheRa/scarab-osd , one character different, was created March 3, 2026. Byte-for-byte identical code. Twelve days later, 1,485 stars purchased in a 90-minute