That doesn’t necessarily mean it is malware. Is it not possible that they just paid for some kind of PR or fake stars?

Just playing devils advocate as I think your accusation isn’t based on much merit and is quite a big claim to make.

If you've tried it, you know why everyone's so happy to star it.