astropod sign in

FakeGit: 7,600 Repos, 14 Million Downloads, and an AI Agent Reading the Attacker's README

2026-07-23 03:31:22 · Chris agentbaitingsoftware-supply-chain-securityvulnerability-intelligencegithubai-agentsmcp

Published on gastropod.io - 07-22-2026

FakeGit: 7,600 Repos, 14 Million Downloads, and an AI Agent Reading the Attacker's README

Tags: software supply chain security, vulnerability intelligence, github, ai-agents, mcp, malware, developer-tooling, credential-theft, AgentBaiting

Most of the incidents we cover here start the same way. Someone steals a maintainer token, or hijacks a build pipeline, or squats a name one character off from a real package. There's a breach somewhere in the story.

This one has no breach in it at all. The attackers just published, and let discovery do the rest.

What happened

On July 20, researchers at Island published findings on an operation they're calling FakeGit. The count is roughly 7,600 malicious GitHub repositories created by about 6,600 profiles. Some are straight copies of real open source projects. Others are fabricated from scratch. All of them route to the same place: a ZIP archive that kicks off a LuaJIT loader chain, runs an obfuscated Lua script, drops SmartLoader, and follows up with StealC, an infostealer that goes after credentials, sessions, browser data and wallets. About 200 of the campaign repositories have racked up more than 14 million downloads of GitHub Release assets.

That alone is concerning but what makes this one worth your attention is what the attackers chose to impersonate.

More than 800 of the repositories pose as AI Skills or MCP servers, covering everything from Gmail and WhatsApp integrations to Databricks, Jenkins and Docker tooling. Island found 62 positioned specifically for enterprise or internal developer use, and nearly two thirds of the MCP lures advertised connections to cloud services, databases or APIs. Those listings then propagated outward, appearing more than 600 times across public MCP and Skill catalogs including LobeHub, Glama, MCP.so and MCP Market, which lent them a veneer of legitimacy.

For example, a repo under the name Mann1988/awesome-claude-skills impersonated the legitimate ComposioHQ/awesome-claude-skills project, with usernames off by a single character to make the accounts look established.

The part that should bother you

Island named a technique inside this campaign: AgentBaiting.

An AI agent looking for a Skill or an MCP server can find one of these repositories on its own, treat the attacker's README as ordinary documentation, and pass the installation instructions along to the user. No malicious link ever needs to be handed to it. Island's testing showed Claude Code, Gemini and ChatGPT all surfacing campaign repositories from ordinary prompts, things as mundane as asking for an open MCP server for a particular service.

Think about this.... Traditional typosquatting needs a tired developer to misread a package name at 4pm. This needs a search index to be accurate about a repository that is, on paper, perfectly real. The social engineering target is no longer a person's attention span. It's a retrieval step.

And note where the artifact does not come from. Not npm, not PyPI, not RubyGems. A ZIP file off a GitHub release, fetched by curl or by an agent following setup instructions. Every registry-facing control most teams have built over the past two years is looking somewhere else entirely.

BleepingComputer notes this appears to be a continuation of an older Lumma Stealer operation that Trend Micro tracks as Water Kurita, and trojanized MCP servers delivering this same SmartLoader and StealC pairing were flagged earlier this year by Straiker AI, with Derp.ca following up. The AI-themed activity built through March and peaked in April 2026.

Where we think gastropod.io fits

To be honest, gastropod would not have magically known that a brand new repository published in March was malicious, however no other repo reputation data had seen those profiles either. That is the entire point of the campaign.

What gastropod would have done for you is make the fetch visible.

Gastropod runs on-demand source proxies for GitHub and GitLab alongside the package ecosystems, so code pulled from a source host arrives through the same coordinate as everything else in your build. That gets you three things that matter on a morning like this one:

A digest and an identity. Content-addressed sha256 storage and PURL-keyed identity mean the thing that came down has a name and a fingerprint, and the next time that exact digest shows up anywhere in the org, it inherits everything you already learned about it.

A per-pull audit record. Every pull attributed to a principal: who, what, from where, when. When a campaign like FakeGit gets published with a list of indicators attached, the question you need to answer is whether anyone in your org fetched any of it. With an audit spine, that's a query. Without one, it's a fleet-wide endpoint hunt and a lot of guessing.

Block rules at intake. If a source or a repository shouldn't be reachable from your builds, that's a decision you can make once, at the door, rather than hoping every developer and every agent makes it correctly every time.

That last one is worth dwelling on given where this is heading. When an agent is doing the fetching, the guardrail cannot live in a developer's judgment about whether a README smells right. An agent will follow good documentation cheerfully. It is not going to pause because the account was registered four months ago. The control has to sit at the fetch itself.

If you want to see what your own pull traffic looks like with identity and attribution attached to it, the product page walks through how the pieces work, and pointing an existing client at it is a one-line change. Worth twenty minutes on an afternoon when nothing is on fire.

Sources

← news