This means 4.5M fake accounts. GitHub does a good job of detecting bots, but room for improvements still exists.
> In total, StarScout identified 4.53 million fake stars across 22,915 repositories (before the postprocessing step designed to remove spurious ones), created by 1.32 million accounts; among these stars, 0.95 million are identified with the low activity signature and 3.58 million are identified by the clustering signature. In the postprocessing step, StarScout further identified 15,835 repositories with fake star campaigns (corresponding to 3.1 million fake stars coming from 278k accounts).