Dependency trust signals are a market for lemons, and 54.6% of published advice comes with no action taken.

Coding 252 Google Search sources and 870 Reddit threads on how practitioners judge open-source dependencies, the study finds stars, download counts and contributor activity collapsing under three simultaneous forces: adversarial manipulation, gaming indistinguishable from legitimate behavior, and non-adversarial inflation driven by legitimate AI tooling. Proposed remedies substituted one gameable signal for another. (arXiv 2608.20678) The authors argue costlier signals like cryptographic attestation have to be mandatory rather than voluntary, and the 54.6% figure is why.