For all speculation around supply chain attacks with fake Github stars, the article says:

"our study does not find any evidence of fake stars being used for social engineering attacks"