It's easy for an open-source project to buy fake GitHub stars. We share two approaches for detecting them.