A fake GitHub installer repo called actual-multi-display-configurator looked wrong to me, so I checked it without cloning it or running a line. It turned out to be one of dozens built from the same template. I read everything through the GitHub REST API , which only downloads text. I never opened the project's web page, and I never decoded the encoded script on it, so what follows about the payload is inference.

What looked off: stars without forks

The repo was five days old and had 767 stars and zero forks. Real projects pick up forks as they pick up stars, because people use them. The owner account was created in 2024, had no followers, and had two public repos. The other one was created four minutes before this one.

The profile also shows a Starstruck badge tied to this repo, a tier that needs 4,096 stars. The repo now shows 767. If that's right, more than 3,000 stars disappeared in days, which is what happens when GitHub bans a batch of fake accounts and their stars go with them.…