I don't see any hint on how to recognise, or how not to recognise them. Did the projects have lots of stars? Fake issues and pull activity? What kind of softwar

I don't see any hint on how to recognise, or how not to recognise them. Did the projects have lots of stars? Fake issues and pull activity? What kind of software did they claim to be? Did they work, to avoid it being obvious after executing and the user reporting the repository to Github? How hard was it to spot the malware, underhand C contest level or obvious if you just open the right file (among hundreds, I guess) and see it do illegitimate things? All it says is that the projects were written in different common languages...