Forensic audit of GitHub star vendors: SMM panels vs calibrated telemetry

The open-source market for repository social proof is divided into three distinct architectural models: disposable social media marketing (SMM) reseller panels, public OAuth-based star exchange networks, and calibrated aged developer dispatch. Understanding the forensic signatures of each model is essential to protecting your repository from security compromises and platform purges.

1. Archetype 1: Bulk SMM panels ($5-$15 / 1,000 stars)

Generic reseller panels (such as Niubistar, Baddhi Shop, and automated Telegram bots) operate on high-volume, low-cost bot infrastructure:

• Account creation batching: Accounts are registered in automated batches using headless browser automation on cheap datacenter IP ranges (Hetzner, OVH, DigitalOcean). These profiles have 0 public repositories, 0 commit history, and no followers.
• Linear cron delivery: Orders dump 500-1,000 stars in minutes or divide volume using basic integer math (Math.floor(1000 / 14) = 71 stars/day), emitting a detectable periodic clock signal without forks or watchers.
• The 72-hour purge cliff: GitHub automated abuse detection regularly purges low-activity account clusters. Within 48 to 72 hours, 70%+ of delivered stars disappear, producing a sharp vertical drop on star-history.com that destroys repository credibility.

2. Archetype 2: Public OAuth star exchanges

Star-for-star platforms operate as reciprocal exchange networks where developers authenticate with their personal GitHub accounts to trade stars:

• Supply-chain attack surface: These platforms require maintainers to grant OAuth tokens with public_repo or read:user scopes. Storing write-capable tokens in third-party databases exposes your account to token leaks, unauthorized stars, and potential repository tampering.
• Bipartite reciprocal cycles: In GH Archive event streams, exchange networks form dense bipartite cycles: User A stars Project B while User B stars Project A within short time horizons. Academic detection algorithms like StarScout (arXiv:2412.13459) and CopyCatch flag these reciprocal cliques, triggering shadow-bans from GitHub Trending.

3. Archetype 3: SG-Tree Zero-OAuth calibrated dispatch

SG-Tree replaces bot farms and token exchanges with telemetry-calibrated developer cohorts:

• Zero-OAuth OpSec: We operate strictly on public GitHub repository URLs. No OAuth tokens, no personal access tokens, and no write permissions are ever requested or stored.
• Aged 2018-2023 cohorts: Stars originate from aged accounts registered between 2018 and 2023 (1yr+, 2yr+, 3yr+ Senior) with independent public repositories, historical commit graphs, and organic followers.
• Hamilton integer apportionment: Floating-point pacing curves (Gaussian, front-loaded, stealth) are apportioned via largest-remainder integer math (integerApportion), combined with diurnal circadian jitter to match natural developer working hours.
• Enforced triad equilibrium: Every package pairs stars with 10% forks and 4% watchers, preserving organic ratios.
• 30-day automated hourly refill SLA: A Cloudflare Worker cron job monitors repository counters hourly, dispatching free refills if net count drops by ≥ 3 units.

4. Forensic vendor comparison matrix