The fabricated commit history is the tell most people miss, since a real repo has messy issues, PRs, and several contributors over time while a scam repo is one author spraying commits in a single day. I check the contributors graph and issue tab before running anything, and if...