# 4 days, 800 stars, 11 downloads: a Steam inventory valuation repo that's actually a poisoned package · GitHub open-source project

> Source: https://stringers.io/en/github/gh_AssassinCreator__steam-stash-value-report-card.html (Stringers / 什么值得做, generated 2026-11-08)
> Stringers answers one question every day: what small product can one or two people build in a few months and actually make money from. Numbers come from 15 databases we collect daily, each with source and date.
> For agents: these verdicts and the underlying databases (verified revenue, App Store / Google Play charts, ad libraries, GitHub, Product Hunt…) are queryable live over MCP — tools today / hot / products / directions / direction / data. Setup: https://github.com/komako-workshop/stringers (the user logs in at stringers.io → "配置 agent" to get a personal URL). Site index: https://stringers.io/llms.txt

> It isn't a real hit. The stars and forks were pumped by a batch of fake accounts, aimed at gaming GitHub search and trending lists to lure Steam players who will download a Windows program; real downloads were only 11.

[GitHub open-source project](https://stringers.io/en/github/index.md) · written 11-6

AssassinCreator/steam-stash-value-report-card · AssassinCreator

# 4 days, 800 stars, 11 downloads: a Steam inventory valuation repo that's actually a poisoned package

**What it is** A Python tool that claims to value your Steam inventory in the terminal and generate shareable cards. The actual download is malware disguised as a signed program.

**Why it blew up** It didn't really. The stars and forks came from a batch of fake accounts, meant to game GitHub search and trending lists and funnel Steam players who download Windows programs. Real downloads: only 11.

**E** **What you can do with this** Don't. The only thing worth learning is how to spot this kind of star-farmed, poisoned repo. If you really want to build a Steam tool, valuation is already saturated by free plugins and trading sites with millions of users. Build something with verifiable source code and no sketchy exes.

Grade E: a star-farmed, poisoned repo with no real growth to copy. Copying it gets you banned, and the real demand is already taken by free, established products. Almost nobody knows about it yet

Data (updated daily) · repo created 2026-11-02 · 791 stars

GitHub · stars

Data 2026-11-03 → 2026-11-08 (6 days, 6 observations). Points before 10-28 come from deeply / archive backfill, not every day has one

A Python project on GitHub called steam-stash-value-report-card got 575 stars the day after it was created, then over 800 in 4 days. It looks like a cold-start textbook. Up close, the stars were bought, and the "signed, no warnings" Windows package in the downloads is a poisoned build that abuses a Notepad++ signed updater to load a malicious DLL. This piece covers how it dressed up as a hot project, how to spot repos like it at a glance, and why there's nothing here for you to copy if you're chasing stars.

### An account with 0 followers, 575 stars on day one

In 2026, Nov 2 (UTC) in the early hours, the account AssassinCreator created this repo. By 11-03 it had 575 stars and 50 forks, then gained +120, +44, +63,11-06 per day, reaching 802 during the day (GitHub displayed 828 that day).

The account was registered 2026-08-14, with 0 followers and 0 following. Its other repo is called `uzgplmqw`, a string of random letters, with 0 stars. No tweets, no Reddit posts, no HN. Searching X for "stashcard steam" over the last ~30 days turns up nothing. A new account nobody knows, with no external links, collecting 575 stars on day one: no organic source explains that.

### What it claims to be

The README calls it "Stashcard": in the terminal, it values your Steam account's CS2, Dota 2, TF2, and Rust inventories, compares prices against the Steam Market and cash-trading sites, and outputs a shareable "report card" image.

The README looks polished: badges, animated GIFs, a dozen-plus sample cards, a CHANGELOG, CONTRIBUTING, CI config. `src/stashcard/` contains twenty-some Python files, each 30 to 40 KB. The download section has one entry, one zip, with a line underneath:

> `Main.exe` is code-signed, so Windows starts it without a warning.

"Code-signed, Windows won't show a warning." That line is the biggest tell.

### What the "signed" exe actually is

The zip for v1.0.1 is about 1.58MB and contains three files (static inspection, not run):

| File | What it actually is |
|---|---|
| Main.exe | Version info reads "WinGup for Notepad++" and "Copyright 2018 by Don HO", with a DigiCert signature from Notepad++. It's Notepad++'s official auto-updater, renamed. |
| gup.xml | The original config file for that updater |
| libcurl.dll | 5.7MB, unsigned, compiled 11-03 13:59, half an hour before release. The section table has abnormal names like `.3c0714`, and roughly 5MB of extra data that looks like an encrypted payload. |

When this updater starts, it loads libcurl.dll from the same directory. The signature is real, so Windows shows no warning. What actually runs is the DLL next to it. This is DLL sideloading, a common poisoning technique. The package contains no Python, no image libraries, no fonts. The twenty-odd source files in the repo have nothing to do with this package; they're just there for show. Which malware family the DLL is was not confirmed by dynamic analysis, so it's unverified. That it's used for poisoning is well supported by the evidence.

Choosing Steam inventory as the bait wasn't random: CS2 skins are worth real money, and stealing a Steam session lets an attacker sell the inventory directly (inference).

### How the 800 stars came about

- **Stars don't match usage** : 828 stars, 0 watchers, 0 issues, Release downloads 11 (GitHub, 11-06). Stars are 75× downloads. A tool people actually use doesn't look like that.

- **The forkers are a pool of accounts** : of the sampled fork accounts, 9 of 10 were registered in 2026, with 0 to 1 followers, and names like `kader246800-gif`, `wakaoliver653-boop`, `trishakhan8322-cyber`. Their repos are all forks of the same batch of fake tools: `pc-game-fps-doctor`, `valorant-fps-lag-fixer`, `osint-people-checker`, `stolen-crypto-tracer`, `HydraSoft-DLL-Hijack-Scanner-ByPass-UAC`... Some upstreams have already been 404, likely taken down by GitHub.

- **Sibling repos** : FollowerDemolish/steam-inventory-tracker-valuator, whose account was registered the same day as AssassinCreator's, 6 minutes apart. It has 329 stars and a 1.57MB download package, almost the same size as this one, with 3 downloads. MythicHokageRepel/steam-inventory-value-desktop got 397 stars on the day 11-05 it was created, with 8 downloads. There are also at least 6 `task-bar-hero-helper-light-version` repos with word-for-word identical descriptions, each with 35 to 52 stars.

- **The timestamps are fabricated** : only two commits, with author dates of 10-08 and 10-18, yet the repo was created 11-02. The README's install command points to a repo called steam-account-value-checker that doesn't exist. The template was renamed without fully cleaning up.

Who are these stars for? GitHub search, and aggregator sites that rank repos by star velocity. hotrepo.ai has already listed it as trending. This July, BleepingComputer and others reported a campaign called FakeGit, which used roughly 6,600 throwaway accounts to create about 7,600 fake repos, pushing infostealer malware with the same playbook of polished READMEs plus bought stars (summarized by hexnode 2026-07-27). Trend Micro also reported this year on BoryptGrab, delivered through fake GitHub pages. Those two campaigns used different loaders from this one, so whether it's the same group can't be confirmed. The playbook is the same, though.

### The real demand was already filled long ago

"Show me what my Steam inventory is worth" is real demand, but people have already built it for free, and you don't need to download an exe:

| Product | Where | Scale |
|---|---|---|
| Steam Inventory Helper | Chrome extension, since 2014 | 1M users, rating 4.86 / 18k reviews |
| Steam-Economy-Enhancer | Open-source userscript, since 2016 | 2,040 star |
| Skinpock, tradeit.gg, Pricempire, CSFloat | Valuation pages built into trading sites | Enter a Steam ID and get results. Top of search. |

So even if someone built a clean "Steam inventory report card," they'd be squeezing into a space where free tools with millions of users have existed for a decade.

### If it were you

**The verdict** : Don't follow this. No real project took off here. It's a sample of inflated stars and a poisoned package dressed up as a hot repo. The 800 stars are fake. The 11 downloads are the real signal.

**Who it's for** : Nobody should copy it. The two groups worth watching are developers who find projects on GitHub and casually download Windows builds, and people who run trending lists, trend sites, or "rising stars this week" roundups. Don't push repos like this to your readers.

**Who it's not for** : Anyone trying to copy the "4 stars in 800 days" curve. That curve was built with a bought account pool. If you replicate it, GitHub will ban you, and the stars won't bring followers or reputation, which is exactly what you want from open source.

**How to spot repos like this** (run through this before downloading any exe):

1. The account has 0 followers and only one or two repos, yet hundreds of stars within a few days.

2. Hundreds of stars, but watchers at 0 and issues at 0, and Release downloads under 5% of stars.

3. Click through a few forkers: names with auto-generated suffixes like `-gif`, `-boop`, `-cyber`, whose repos are all "FPS optimizer", "UAC bypass", "crypto tracker", "game inventory valuator" types, the kind that gets people to run a Windows program.

4. The README stresses "signed, no warnings" and "portable, no install." The exe's version info doesn't match the project name, and next to it sits an absurdly large DLL.

5. The source is Python, but the download is an exe with no runtime bundled. Commit dates predate the repo creation date. Links in the README point to repos that don't exist.

**If you really want stars for a Steam tool** : don't build valuation. That's already the turf of Steam Inventory Helper and the trading sites. What actually earns stars is being open and transparent: source you can run directly with `pip install`, no exe, or if you do ship a binary, have CI build it from source and publish checksums. In a niche polluted by fake repos, "you can verify this is clean" is itself the selling point (inference).

**What would prove this read wrong** : if this repo and its siblings picked up real issues and real user discussion over the next few weeks, with Release downloads climbing to match the stars, and someone reproduced the same program from source, then it would be a real project that got wrongly accused. Based on current evidence, that's unlikely.

[GitHub repo ↗](https://github.com/AssassinCreator/steam-stash-value-report-card)

**Research notes: competitor table, acquisition evidence, full research report**

Competitors

| Name | Where | Launched | Scale | How it differs from this one |
|---|---|---|---|---|
| Steam Inventory Helper | Chrome | 2014-06 | 1M users, 4.86/18k reviews (chromestore library) | Real product: see inventory prices in the browser, no exe download |
| Nuklon/Steam-Economy-Enhancer | Open source | 2016-11 | 2,040 stars (github library) | Real open-source userscript that enhances the Steam inventory and market pages |
| Skinpock / tradeit.gg / Pricempire / CSFloat inventory valuation pages | Web | Years ago | Free tools built into trading sites, ranking high in SEO | Enter a Steam ID and get a report, zero install |
| Steam GG.deals price panel | Chrome | 2026-04 | 577 users (chromestore library) | Niche real plugins |

Where users come from

- **Verified** **Star/fork farming (account pool)** : a 0-follower new account got 575 stars on the first day the repo was created. Sampling 10 forkers, 9 were registered 2026 years ago with 0-1 followers and auto-generated usernames, and their repos are all forks of the same batch of fake tools (pc-game-fps-doctor, osint-people-checker, etc.), some of whose upstreams have already been 404.

- **Verified** **GitHub search and trending aggregators** : hotrepo.ai already indexes it; our recall also pulled it in by star growth

- **Verified** **Topic + signed binary to avoid warnings** : Main.exe is actually gup.exe carrying Notepad++'s DigiCert signature, and the README stresses 'code-signed, starts without a warning'. libcurl.dll is unsigned, compiled half an hour before release, and has non-standard sections and 5MB of encrypted data

- **Verified** **Bulk account farming** : account 2026-08-14 registered and created a random-named placeholder repo uzgplmqw; sibling account FollowerDemolish registered the same day, 6 minutes apart

## AssassinCreator/steam-stash-value-report-card: not a product, but a repo distributing star-farmed malware

> Research date 2026-11-06. The conclusion first: **this repo did not 'take off', it's a mirage.** Its 802 stars (GitHub API that day: 828) are essentially bought, and the Windows portable package in Releases was not built from the Python code in the repo. It is 'a legitimately signed Notepad++ updater + a malicious libcurl.dll', a classic DLL side-loading poisoned package. It belongs to a batch of fake repos using the same playbook. There is no product experience to learn from; the only takeaway is how to spot this kind of recall.

### 1. What it claims to be

The README calls it "Stashcard": a terminal tool that values a Steam account's CS2 / Dota 2 / TF2 / Rust inventory, compares Steam Market and cash-exchange prices, and outputs a shareable "report card" PNG. The README is polished: badges, animated GIFs, a dozen sample cards, CHANGELOG, CONTRIBUTING, CI config. `src/stashcard/` holds about 25 Python files (cli.py 35KB, render/cards.py 48KB). The download section has a single entry, `steam-stash-value-report-card.zip`, with the wording "`Main.exe` is code-signed, so Windows starts it without a warning".

### 2. Evidence: the Release package is a malicious drop

I downloaded the v1.0.1 zip (1,581,882 bytes, sha256 `1805d9ad…cb88a`), did only static inspection without running it, and deleted it afterward. It contains just three files:

| File | Size | What they really are |
|---|---|---|
| Main.exe | 804,688 | The version info is `gup.exe` / "WinGup for Notepad++" / "Copyright 2018 by Don HO", carrying Notepad++'s DigiCert code signature, with PE timestamp 2024-10-25. It is the official Notepad++ update program with a renamed binary. |
| gup.xml | 4,608 | The WinGup config file, unchanged |
| libcurl.dll | 5,747,064 | Unsigned, PE timestamp **2026-11-03 13:59** (compiled half an hour before release). The section table has non-standard sections like `.3c0714`, `.38f8ae`, and `.rsrc2`, and `.rdata` is 5.2MB (a typical encrypted payload). The export table only pretends to be curl with function names. |

When gup.exe starts, it loads libcurl.dll from the same directory. That is DLL side-loading: a **legitimately signed program** gets past SmartScreen ("Windows starts it without a warning"), while the attacker's DLL is what actually runs. The package contains no Python runtime, Pillow, fonts, or anything else; the source code in the repo has nothing to do with the release package and is just bait. I did not perform dynamic analysis to identify the family (infostealer / loader), so that is **unverified** , but the poisoning intent is well supported.

Public reports of the same kind: Island / BleepingComputer (2026-07) disclosed the FakeGit campaign, which used about 6,600 disposable accounts to create about 7,600 fake repos, relying on "polished README + faked stars" to deliver SmartLoader / StealC (source: hexnode.com/threat-watch/fakegit-malware-github-repositories-smartloader-stealc, 2026-07-27). Trend Micro's 2026 annual report covered BoryptGrab, which also used fake GitHub repos to deliver infostealers (trendmicro.com/en/research/26/c/boryptgrab-stealer-targets-users-via-deceptive-github-pages.html). FakeGit uses a LuaJIT loader, unlike this "signed gup.exe + libcurl.dll" chain, so **we cannot confirm** it is the same group, only the same playbook.

### 3. Evidence: the stars and forks are fake

- **Accounts** : AssassinCreator registered 2026-08-14 08:12, with 0 followers and 0 following. Another repo is named `uzgplmqw` (random letters, 0 stars). The account behind a similar repo, FollowerDemolish/steam-inventory-tracker-valuator, registered 2026-08-14 08:06. **Six minutes apart on the same day** , clearly batch registration followed by two-plus months of 'aging' before use (GitHub API).

- **Growth curve** : 2026-11-02 00:40 repo created; by 11-03 our records show 575 stars / 50 forks, then 695 → 739 → 802 (github repo_day). A new account with 0 followers and no external links gaining 575 stars on day one has no natural explanation.

- **Stars are out of proportion to usage** : 828 stars, but watchers (subscribers) = 0, issues = 0, and Release downloads are only **11** (GitHub API, 2026-11-06). A tool people actually use would not have 75 times more stars than downloads.

- **Fork accounts** : I sampled 10 forkers; 9 registered 2026 years ago (most in 2026-09 through October), with 0–1 followers. Usernames follow GitHub's auto-generated suffix pattern, such as `kader246800-gif`, `wakaoliver653-boop`, `dsathi558-spec`, `trishakhan8322-cyber`, `abunayem5660-eng`. Their repo lists are almost entirely forks of the same batch of fake tools: `pc-game-fps-doctor`, `valorant-fps-lag-fixer`, `osint-people-checker`, `stolen-crypto-tracer`, `HydraSoft-DLL-Hijack-Scanner-ByPass-UAC`, `windows-drive-space-finder`, `steam-inventory-value-desktop`, and more. The upstream of `Centiplatrap/pc-game-fps-doctor` has already been 404 (likely taken down by GitHub). This is an account pool built specifically to fork and star fake repos.

- **Forged commits** : only two commits, with author dates of 2026-10-08 and 10-18, yet the repo was created 11-02. The README contains `pipx install git+https://github.com/AssassinCreator/steam-account-value-checker.git`, which points to a nonexistent repo. The template was renamed but not fully cleaned up.

- **The stargazers list API returns 404** (a normal public repo would not), so I could not verify the starring accounts one by one.

### 4. "Competitors" and copycats

Real demand for Steam inventory valuation does exist, and it was saturated long ago:

| Name | Where | Launched | Scale | How it differs from this repo |
|---|---|---|---|---|
| Steam Inventory Helper | Chrome | 2014-06 | 1M users, rated 4.86 / 18k reviews (chromestore data) | A real product: view inventory prices right in the browser, no exe download needed |
| Steam-Economy-Enhancer (Nuklon) | Open source | 2016-11 | 2,040 stars (github library) | Real open-source userscript that enhances the Steam inventory and market pages |
| Skinpock, tradeit.gg inventory calculator, Pricempire, CSFloat, and others | Web | Years | Free valuation pages built into trading sites, ranking high in SEO (Jina search results) | Enter a Steam ID and get a report, zero install |
| Steam GG.deals price panel | Chrome | 2026-04 | 577 users | Niche real plugins |

The "copycats" in this batch are actually **sibling repos from the same group** , not independent imitators:

- MythicHokageRepel/steam-inventory-value-desktop: created 2026-11-05, got 397 stars / 30 forks on day one (github repo), account registered 2026-08-12 with 0 followers. The Release is a 6.6MB `Glasscase-2.5.0-portable-x64.exe` with 8 downloads.

- FollowerDemolish/steam-inventory-tracker-valuator: 329 stars / 0 forks. The Release is also a zip, 1,574,301 bytes (almost the same size as this repo's 1,581,882), with 3 downloads.

- KL93992ycan / ArrowIgnite83 / MomentumNautilus / NebsensorMind and at least 6 other repos named `task-bar-hero-helper-light-version` with word-for-word identical descriptions, 35–52 stars (github repo).

### 5. Growth tactics, dissected (from the attacker's view)

1. **Bulk account farming** : register accounts two or three months ahead, create a random-named placeholder repo to lower the 'new account' suspicion.

2. **Topic choice** : Steam inventory valuation, FPS optimization, OSINT, crypto tracing, UAC bypass. All are topics that attract people who willingly download Windows exes. Skins in Steam inventories are valuable in themselves, so stolen accounts can be turned into cash by selling the skins.

3. **Disguise as a mature project** : AI-generated complete Python source, polished card images, badges, CI, CHANGELOG, so a casual glance or a GitHub search looks like a real project.

4. **Star/fork inflation to game GitHub search and aggregators** : the fork account pool inflates the numbers; aggregators like hotrepo.ai have already listed it as trending (Jina search hit hotrepo.ai/AssassinCreator/steam-stash-value-report-card), and our recall system pulled it in as well. Inflating stars exists precisely to fool systems that rank by star growth.

5. **Side-loading through a signed program** : the legitimately signed Notepad++ gup.exe is used to avoid Windows warnings, and the README even proactively advertises "signed, no warning".

6. **Where the money comes from** : monetization via stealing browser credentials, Steam sessions, and crypto wallets (inferred; the specific family is **unverified** ).

No real discussion found on X (searching the past 30 days of x-radar corpus for "stashcard steam": 0 results), Reddit, or HN.

### 6. Verdict

- Why it 'took off': **it didn't** . The star growth was entirely produced by a pool of farmed accounts; actual downloads were only 11.

- Differentiation: none for users; for attackers, 'differentiation' means 'a signed exe that skips warnings + targeting Steam players, a group with valuable assets to steal'.

- What it means for us: the recall rules treat "new repo, single-day spike, high fork/star ratio, single-repo account, Windows portable build" as positive signals, which are exactly the traits of these fake repos. Suggest adding filters to GitHub recall: owner 0 followers + repo created within 7 days with stars >300 + release downloads / stars < 5%, or subscribers_count=0 and stars >200, and directly flag as "suspected star-farming / poisoning".

### Sources

- GitHub API: repos/AssassinCreator/steam-stash-value-report-card (stars 828, subscribers 0, release downloads 11), users/AssassinCreator, fork list and fork-owner accounts, sibling repo releases (2026-11-06 crawled)

- Release zip static analysis (local, not executed, since deleted)

- Our github tables repo_profile / repo_day; chromestore table item

- Jina search: hexnode FakeGit coverage, Trend Micro BoryptGrab, hotrepo.ai listing page

- x-radar: "stashcard steam", 0 posts in the last 30 days

This article was written by AI from public data and the data we collect daily. Numbers are sourced, and inferences are labeled.