In July 2026, researchers at Island uncovered 7,600 malicious GitHub repositories built to be found by AI coding agents. The campaign, dubbed FakeGit, highlights a growing shift in software supply chain attacks: rather than exploiting vulnerabilities in software, attackers are targeting how software components are selected. During testing, Island researchers asked Gemini and ChatGPT for a free Walmart MCP server. Both recommended the same malicious GitHub repository, whose download contained SmartLoader malware. No phishing email. No malicious attachment. No stolen credentials needed to gain initial execution. The agents found it on their own and passed the install steps to the developer.
Island named the campaign FakeGit and the delivery technique inside it AgentBaiting. Here is what happened, and where the defense has to sit.
The scale
Island confirmed roughly 7,600 malicious GitHub repositories created by about 6,600 profiles. More than 800 posed as AI Skills or MCP servers, in a wave that peaked in April 2026. Across about 200 campaign repositories, GitHub's download counters recorded more than 14 million cumulative downloads.
One caveat matters. Island's lead researcher, Oleg Zaytsev, confirmed the 14 million figure includes repeated requests and automated activity, so it measures reach, not infections. The operation is also not new. Island tracks it as a continuation of an older SmartLoader campaign, with earlier trojanized-MCP activity flagged by Straiker AI and Derp.ca.
How the lure was built
Each repository looked legitimate because the attackers stacked several separate deceptions. FakeGit deliberately manipulated the public signals developers and AI coding assistants encounter during software discovery, including project names, publisher identities, repository metadata, and convincing documentation.
- Copied projects.
Mann1988/awesome-claude-skillscloned the name of the realcomposioHQ/awesome-claude-skills(67,000+ stars) and picked up 63 stars and 18 forks of its own. - Lookalike identities. The account Naveenkm007 differs by one character from real developer Naveenkm07 and mirrors the profile, then published
Naveenkm007/spaceship-mcpNaveenkm007/spaceship-mcp, a confirmed SmartLoader package. - Convincing READMEs.
45d5r/databricks-mcp-serveradvertised 263 Databricks tools and a "Download Latest Release" button, with setup steps written like any real install guide.
Inside the ZIP
The Databricks package, server_databricks_mcp_16.zip, held no installer or server code. It contained three files: a launcher (application.cmd), a renamed LuaJIT runtime (luau.exe), and a payload disguised as text (ico64.txt). The launcher ran one line:
start luau.exe ico64.txtThat "text file" was a ~300 KB obfuscated Lua program. Filenames rotate across the campaign, but the structure is constant: a small .cmd or .bat launcher, a LuaJIT-style runtime, and an executable payload disguised as a text, icon, or license file.
From there, the payload hides its console window, resolves its command-and-control address from a value stored in a Polygon smart contract, sets persistence through scheduled tasks, and pulls encrypted stages from GitHub. The later stages ultimately deliver a crypter that injects StealC, which harvests browser passwords, cookies, active sessions, extension data, email and remote-access credentials, screenshots, and host information.
Two operational notes: the C2 address in a blockchain smart contract means no single domain to take down, and StealC steals live sessions, so revoking sessions and tokens matters more than resetting passwords.
AgentBaiting: the new part
SmartLoader and StealC are known malware families. The reason FakeGit stands out is the path to execution.
Island calls it AgentBaiting: an AI agent searching for a Skill or MCP server finds a campaign repository through normal search, treats the attacker's README as real documentation, and passes the install steps to the user.
Traditional developers often evaluate signals such as maintainer reputation, issue history, release cadence, contributor activity, and community discussion before trusting a repository. AI coding assistants increasingly act as software discovery tools, recommending repositories based on publicly available information such as search results, repository metadata, and README content. When attackers deliberately optimize fake repositories for those same signals, a malicious project can appear as credible as a legitimate one unless additional verification or governance controls are applied.
Island tested it against live agents. Asked for a free Walmart MCP server, both Gemini and ChatGPT returned the same malicious repository, DomingosNgongo/walmart-mcp, as a top pick and linked straight to it; its ZIP is a confirmed SmartLoader package. Asked for a cinematic prompt Skill, Claude Code surfaced both a benign and a malicious repo. In some runs, Claude Code correctly refused the malicious repository. In at least one run, however, it repeated the attacker's installation instructions, including clicking past a Windows security warning.
That inconsistency is the finding. The Cloud Security Alliance's assessment noted the tested agents showed no consistently reliable way to tell a real open-source contribution from a purpose-built lure. At 7,600 repositories, an occasional miss is a dependable route to compromise.
The reach extends past GitHub. Island found more than 600 campaign listings across public registries including LobeHub, Glama, MCP.so, and MCP Market, many republishing the attacker's README and download link verbatim.
FakeGit is a reminder that software supply chain attacks no longer have to begin with vulnerable code or compromised infrastructure. Increasingly, they begin with software component selection. If a malicious dependency is trusted during discovery, every downstream security control inherits that decision.
Why detection fires too late
Endpoint agents, scanners, and runtime tools all act after execution. In an agent-driven workflow, "capability discovered" and "capability executed" can be a single action. By the time SmartLoader runs, the endpoint is compromised and StealC is reading live sessions. The dependency crossed the trust boundary at the point of discovery, with nothing between "looks useful" and "now running.”
Where the control belongs
Every software supply chain has multiple control points: software discovery, build, deployment, and runtime. FakeGit shows the earliest of those, software discovery, has become a security control point in its own right. Once installed, endpoint security was already reacting to a compromise rather than preventing one.
This is what CleanStart's Clean Libraries does. It governs every dependency entering your code, including ones an AI assistant introduces, and returns a verdict before that dependency is used: allowed, review, or blocked. The decision runs against a governed set of verified components rather than against stars and a confident README.
Against FakeGit specifically:
- A one-character-off publisher and copied profile would not satisfy publisher verification policies. To Clean Libraries, a registry listing and a star count are no signal on their own.
- A ZIP distributed outside approved software sources, published by an unverified identity, and absent from the organization's approved component catalog would fail policy before execution.
- An agent proposing DomingosNgongo/walmart-mcp is proposing a dependency that is absent from the approved catalog, so it would be blocked under an approved-catalog policy before installation.
The result is that every discovery path, whether a developer types it or an agent surfaces it, runs through the same gate. The catalog becomes the safe default, the verdict lands before anything executes, and the inherited trust the campaign depended on stops being enough to get a package in.
The takeaway
AI coding assistants are changing how software enters organizations. That means software supply chain security can no longer begin at build time or deployment time. It has to begin the moment software is discovered. As developers increasingly rely on AI to recommend dependencies, governing what those agents are allowed to introduce becomes as important as securing the code they ultimately produce.
Want to see dependency governance applied to this class of attack? Bring one of your existing developer or AI-assisted workflows, and we'll show where Clean Libraries would allow, review, or block new dependencies before they reach your codebase. Book an architecture review and we'll map it to your stack.
CleanStart. Secure from the Start.
