Bot Sent a Trap Repo With 1774 Stars: Author Analyzed 321 Trending Repos

A Telegram bot that collects five trending GitHub repositories from trendshift.io every morning brought "Microsoft Activation Scripts" into its feed on September 26. The project had 1774 stars, a tidy description, tags, and the same README-summary button as the four repositories next to it. It was a trap. The bot's author, who wrote about the incident on Habr, afterward analyzed 321 repositories from the trends and built two filters meant to catch such projects in advance.

The announcement of the post does not say what exactly is inside the repository or how the deception worked. What follows covers what the text does tell us, plus the context that makes the case instructive.

What the trap looked like

The bot's setup is simple. Trendshift.io shows repositories that are gaining attention on GitHub. The bot picks five and sends them to Telegram with a button. You tap it, get a README summary, work out the idea, and sometimes install what you like. The author reads this feed every day.

This format removes the most important signal: contrast. When five projects look the same, checking each one separately feels like a chore. All the more so because they look entirely trustworthy: a star count, tags, a structured description. The bot has no doubts and flags nothing. It retells the README, and the README is written by someone who wants to be believed.

The name was not chosen at random either. Windows and Office activation scripts are the kind of tool people run quickly and with elevated rights, without reading the code. That makes a convenient environment for a fake: the user walks into a gray area on their own and is less inclined to check the source. This is our inference from context, not a claim by the original author.

Why trends offer poor protection

GitHub stars stopped being a reliable metric a long time ago. They can be inflated, and a trending list reflects the speed of growth, not quality or security. A repository with 1774 stars looks noticeable but not loud, so it raises no suspicion.

Parameters known from the text:

• feed source: trendshift.io;
• feed size: 5 repositories per day;
• date of the incident: September 26;
• repository: "Microsoft Activation Scripts", 1774 stars;
• sample for analysis: 321 repositories from the trends;
• result: two filters.

The filter criteria themselves are not given in the available excerpt, so you will need to check the full article. A sample of 321 repositories is large enough on its own to show what a normal trending project looks like and how a fake differs from it. But conclusions drawn from it remain conclusions about one feed and one period.

Automated summaries raise a separate question. If a language model produces the README summary, it inherits all of the document author's tricks and does not verify what stands behind it. The model compresses text, not reputation. The announcement does not say how the summary is built, so this is only a warning for anyone building similar feeds.

How to read trends without getting burned

First rule: install from a trending list only after checking, and the higher the rights a script needs, the stricter the check should be. For activation scripts, installers, and anything that asks for admin, three minutes is enough. Look at the age of the account and the repository, the commit history, and the ratio of stars to forks and issues. Compare the name with the original project: fakes usually have a different owner and suspiciously smooth statistics.

Second: if you are building your own bot or agent that recommends code, add warning labels to the feed. Two or three automated checks before sending are enough, for example a sharp jump in stars on a repository with a short history, or an owner that does not match the known project. The author derived exactly this kind of filter from his 321 repositories.

Third: run unverified code in a virtual machine or container, not on your work laptop. It is not a guarantee, but it sharply lowers the cost of a mistake.

What makes the 1774-star story useful is that nothing in it is exotic. An ordinary morning feed, an ordinary button, an ordinary interest in a fresh repository. That is exactly why it is worth reading in full.