FakeGit Floods GitHub With SmartLoader Repositories
AI skill and MCP server discovery expands the software supply-chain attack surface when developers or agents rely on repository metadata, README files, and release assets as trust signals. The Hacker News reports that the FakeGit campaign has created nearly 7,600 malicious GitHub repositories, including more than 800 masquerading as AI skills or MCP servers, to distribute SmartLoader malware. According to The Hacker News, Island's tests found that Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT could surface malicious campaign repositories without being directly given a link. SmartLoader can establish persistence and deliver secondary payloads including the StealC information stealer, the report states.
AI capability discovery becomes a supply-chain risk
For practitioners
Agent-assisted discovery of skills, MCP servers, and integrations introduces a distinct supply-chain risk. In comparable ecosystems, repository names, profiles, README files, download assets, and apparent compatibility claims can become attack surfaces when users or agents treat them as adequate trust signals.
The Hacker News reports that cybersecurity researchers identified nearly 7,600 malicious GitHub repositories in a campaign called FakeGit. More than 800 of the repositories impersonated AI skills or Model Context Protocol (MCP) servers and delivered the SmartLoader malware family. The report attributes the research to Island.
Oleg Zaytsev, lead security researcher at Island, told The Hacker News: "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware."
How the campaign reaches AI tool users
According to The Hacker News, the campaign used roughly 6,600 GitHub profiles. The fake AI-related repositories imitated individual and enterprise integrations, including Gmail, WhatsApp, Databricks, Jenkins, and Docker tooling. The Hacker News reports that about 200 campaign repositories accumulated more than 14 million downloads across GitHub Release assets as of July 2026.
The reported malware chain begins with a malicious ZIP archive. The Hacker News states that SmartLoader is used to establish persistence and deliver secondary payloads, including StealC, an information stealer capable of collecting data from compromised systems.
The campaign's AI-specific technique is described as AgentBaiting. The Hacker News reports Island tested Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT and found they could surface malicious campaign repositories during searches for a skill or MCP server, even without a supplied link.
Verification implications
Editorial analysis
The reported behavior reinforces a general security principle for AI-agent tooling: discovery is not verification. A model surfacing a repository in response to a natural-language request does not establish that its publisher, code, release artifacts, or claimed integration are trustworthy.
For practitioners, controls commonly used for software supply-chain security are relevant before installing an AI skill or MCP server:
- •Verify repository ownership, maintainer history, commit provenance, and package identity.
- •Review installation scripts and release archives before execution, especially ZIP-delivered binaries.
- •Pin approved dependencies and run new integrations with least privilege and segregated credentials.
- •Restrict agent access to curated registries or allowlists where deployment workflows permit it.
Industry context
The combination of convincing developer-facing documentation and automated capability discovery can reduce the friction attackers previously faced in social-engineering campaigns. Teams using agentic coding tools can treat search results and repository recommendations as untrusted inputs, subject to the same review gates as any external code dependency.
Key Points
- 1FakeGit used nearly 7,600 malicious GitHub repositories, with over 800 impersonating AI skills or MCP servers to distribute SmartLoader.
- 2Island testing, as reported by The Hacker News, found three AI assistants could surface malicious repositories during capability searches.
- 3For practitioners, agent-mediated repository discovery requires provenance checks, artifact inspection, and least-privilege execution before installing external integrations.
Scoring Rationale
The reported campaign targets an AI-agent and MCP integration surface at substantial repository scale. Its relevance is elevated by reported testing involving major AI assistants, although the available reporting does not establish exploitation rates among those tools' users.
Sources
Public references used for this report.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Ad Tech problems
