In reply to Kurt Schlatzer.

Nothing.

And the WordPress.org repo is actively being gamed.

Downloads, active installs, and reviews are able to be manipulated.

The trick is doing it so it doesn’t raise suspicion.

But you can be sure that it is actively occurring given the benefits that would come with inflating these numbers.