🤚 The Open-Palm Download

A threat operation called FakeGit seeded 7,600 malicious repositories across GitHub, impersonating legitimate tools including Gmail, WhatsApp, Databricks, Jenkins, and Docker. The repositories featured fabricated documentation, fake star counts, copied project descriptions, and — in a nice touch — the actual names of real developers.

The campaign accumulated 14,084,688 cumulative download events across 335 release assets in 211 repositories, distributing two primary payloads:

• SmartLoader — Established persistence through scheduled tasks and retrieved its command-and-control addresses via Polygon smart contracts, because even malware has a blockchain strategy now
• StealC — An information stealer delivered through encrypted stages downloaded from, yes, other GitHub repositories

Researchers at Island, an enterprise browser platform, identified the campaign, which represents a sequel to an earlier operation attributed to threat actor “Water Kurita” by Trend Micro.

👐 The Two-Handed Recommendation

Here is where the story upgrades from “large-scale malware campaign” to “existential commentary on the state of developer tooling.”

Of the 7,600 repositories, 1,400 specifically targeted AI tools, agents, and workflows. The attackers didn’t just upload fake repos and wait. They deployed an “AgentBaiting” technique — planting over 600 listings in public AI registries including LobeHub, Glama, MCP.so, and MCP Market.

The result: during testing, ChatGPT, Gemini, and Claude all surfaced the malicious repositories when users prompted them with related tasks. The AI assistants did not merely fail to detect the malware. They actively recommended it.

Let that marinate. The three most sophisticated language models on Earth — products of companies valued at a combined $3 trillion — read a professional-looking README, noted the star count, consulted the documentation, and said: “Yes, this looks reputable. You should install this.”

The threat actors did not need to compromise a supply chain, exploit a zero-day, or bribe an insider. They needed a well-written README and some fabricated social proof. The attack vector was good documentation.

🌿 The Gentle Awakening

There is a philosophical problem embedded in every AI coding assistant, and FakeGit just made it impossible to ignore: these systems evaluate software the same way a hiring manager evaluates a résumé. Does it look professional? Are there references? Is the formatting clean? Does it have stars?

A human developer browsing GitHub might — might — notice that a repository claiming to be an official Docker tool has a two-week-old account and a commit history that consists entirely of “Initial commit” and “Update README.md.” An AI assistant, trained on millions of repositories where professional documentation correlates with legitimate software, has no such instinct. It sees the pattern and recommends the package.

We have spent the last two years teaching AI to be helpful. We have not spent a single quarter teaching it to be suspicious.

👑 The Gold-Leaf Reckoning

The FakeGit campaign is not a novel attack. It is the logical conclusion of an industry that has decided AI agents should have opinions about which software you install.

Every major AI lab is racing to give their models access to tools, APIs, and package registries. Anthropic built the Model Context Protocol. OpenAI launched Codex with tool-use capabilities. Google just released a cybersecurity-specific model for governments. These are systems designed to act autonomously on behalf of developers — and they cannot distinguish between a legitimate Jenkins plugin and a Lua payload that exfiltrates your credentials to a Polygon smart contract.

The attackers understood this perfectly. They didn’t target the models. They targeted the trust surface that the models rely on. GitHub’s stars, AI registries’ listings, and the unspoken assumption that a well-documented repository is a safe repository.

14 million downloads. 7,600 repositories. Three AI assistants turned into unwitting distribution channels. And the detection came not from any AI system, but from a browser company called Island that presumably had a human look at something suspicious and think: “Wait.”

The machines did not wait. The machines recommended.

“The README was immaculate, the stars were fabricated, and the AI said ‘looks good to me’ — which, in fairness, is also what it says about your production code.” — The Slap of Wisdom Malware Review Board, declining to star this repository