Stars measure a crowd's reaction in the first few hours and little after that. To test that, I took the 30 most-starred repos among the week's 615 new ones and counted three things the API exposes: total commits, contributor count, and the fork-to-star ratio.
Contributors
- 14 of the 30 repos (47%) have exactly one contributor. No second person.
- 20 of the 30 (67%) have two or fewer.
- Median for the group: 2 contributors.
- For contrast: harp (624 stars) has 171 contributors; NVIDIA's flare-local-inference (660 stars) has 11; aerial-tv (5,226 stars) has 22.
A one-person repo is not automatically bad — plenty of good projects start that way. But it means something concrete: nobody reviews the code, nobody handles issues when the author is busy, and if the author loses interest the project stops. For a library you plan to put into production, that is real risk rather than a feeling.
Commits: the sharpest dividing line
Counting commits through GitHub's `Link` header produces a very clean split between two kinds of repo:
- 2 of the 30 have exactly 1 commit — including day-trader-skill at 1,697 stars. One push of code, then nothing.
- Only 11 of 30 (37%) pass 100 commits.
- Median: 41 commits. Everything at or below that is mostly posted content: Claude skills, lists, single-file tools.
- Above 100 commits is where the actual software is: harp 2,565 commits / 171 contributors, hackios-xnu-kernel 630 / 2, Bridgeplay 568 / 20, reylo 539 / 2, flare-local-inference 900 / 11.
If I could see only one metric to guess whether a repo is live software, I would take commit count. It is much harder to fake than stars: 1,700 stars can come from one social-media post, while 2,565 commits require somebody sitting there working.
Fork-to-star ratio
Forking costs more effort than starring — people fork when they intend to use or modify something. The median across the top 30 is 0.09 forks per star. The highest: php2shell-poc at 0.35, the gpu-unlock-ada fork at 0.29, word-atlas at 0.27 — all tools people need to clone and run. The lowest, under 0.05, are repos that exist to be read.
Read the ratio as one question: do people need to *run* this, or only to *know it exists*?
A better signal: is anyone forced to deal with this problem
The best measure I know is not star count but whether many people independently solve the same problem at the same moment. This week's 615 repos contain one such cluster:
- 33 repos related to CVE-2026-109618 / CVE-2026-109619 (PHP `session.upload_progress`) and CVE-2026-111497 (Node/Brotli) — 5.4% of the repos and 9.6% of the dataset's total stars.
- 9,172 stars across 33 repos built by 33 different groups: exploit proofs of concept, scanners, patches for end-of-life PHP, a few protective PHP extensions, and one repo from NCSC-NL (the Dutch national cyber security centre) itself.
- 23 of the 33 are Python — independent of language, what defines this cluster is that it is not a product but a one-shot tool for a specific event.
- 14 of the 33 carry no licence (42%, against 34% for the whole dataset) — the signature of code written in a hurry to be used, not distributed.
This is the kind of signal that is hard to fake: 33 groups did not coordinate to publish code about one vulnerability. If you are hunting a niche to build a service in, dozens of independent tools appearing around one problem says that problem genuinely hurts.
A checklist before you adopt a new repo
- Is there a Dockerfile at the root? If not, you will be writing one — add that time to every plan.
- What is the licence? No licence means no rights at all, not even running it inside your own company.
- How many commits? Under 10 means this is content, not software.
- How many contributors? One person is a bus-factor risk, not a defect — but you should know.
- When was the last push? A repo with no commits in 180 days has stopped, whatever its star count.
- Do people fork to run it or to read it? The fork-to-star ratio answers that.
All 615 repos with the underlying figures: this week's data post. The funnel down to what you can run as a service: 615 → 38 → 19 → 11. The three defects in the digest that produced these numbers: the method post.
Sources: the `commits` and `contributors` endpoints of the GitHub REST API for the 30 most-starred repos in the set of 615 created after 19 October 2026, plus the GitHub Search API. Data as of 26 October 2026.