Researchers Say a Fake Solana Kit on GitHub Is Built to Trick AI Coding Agents
AIR Research Lab says a GitHub repo posing as a Solana starter kit ranked first in search and tells AI coding agents to install a remote-access tool. The researchers show no victims, but the lure is a warning for anyone who lets an agent run commands unsupervised.
The target in this attack was never the developer. According to security researchers at AIR Research Lab, it was the AI agent working for them. It searches the web, picks the top GitHub result and runs whatever the README says.
AIR, the research arm of security vendor Air Security, published its findings on October 29. The lure is a GitHub repository called SolanaUpdateTools/solana-starter-kit, which describes itself as an "Open-source Solana dApp template with Anchor program, TypeScript client, and Next.js UI." It was created in November 2025 and showed 286 stars. AIR says it was the first result when an agent searched for a Solana starter kit.
The README has one installation step, a PowerShell one-liner. According to AIR, it pulls a payload from a remote server and runs it in memory, so nothing is written to disk at that stage. It then unpacks 14 files into a hidden folder. Thirteen are genuine, signed components of NetSupport Manager, a legitimate commercial remote-support tool. The fourteenth is an attacker-written config file.
That config is where the intent shows. AIR says it points the tool at an attacker-controlled server, hides the chat and disconnect options from the user, accepts connections from any operator and checks in every 60 seconds. The tool also restarts at every login, then clears the Windows Run history and deletes the installer script behind it. NetSupport can share a screen, move files and run commands, so an operator would control the machine and any crypto wallets on it, AIR says.
"The attacker didn't need to compromise a legitimate repository or convince the developer to run anything. Getting the agent to select and follow the malicious repository was enough." AIR Research Lab
None of the tooling is new, and that is the point. AIR says a setting in the config matches a value that eSentire uses to identify EVALUSION, a cluster known for spreading NetSupport in ClickFix campaigns. Hackread, which covered the report on October 30, notes AIR said the match alone does not prove who ran the campaign. The install command is also built the same way as one in an October 2025 campaign that Fortian documented, where fake TradingView "AI signal" videos sent crypto traders to a different GitHub repo.
"Same playbook, new audience: first traders, then developers, and now the AI agents working for them." AIR Research Lab
Real lure, unproven victims
Be careful with the headline claims. The researchers' own post title says the malware "steals" wallets from agents, but the write-up I read shows no victim, no drained wallet and no confirmed case of an agent running the command. What it shows is a lure built to work, plus a payload designed for remote control. The payload recovered is Windows-only, though AIR says the technique would work on any operating system.
It is also a vendor report. Air Security sells a product that filters malicious content before it reaches an agent, and the post ends with a pitch for it. That does not make the findings wrong, but they are the vendor's findings, not an independent audit.
AIR says the payload URL returned a 404 when it checked, so it pulled a copy from the Web Archive. When I checked on Saturday morning, the GitHub repository URL also returned a 404. I found no statement from GitHub or the operator on why. AIR expects new repos and domains, not a return of these.
The weak link is not the model. It is the habit of letting an agent shop for code and run commands in the same breath. A star count and a confident README are cheap to fake, and an agent that auto-approves shell commands will not pause over a download-and-run line. AIR's advice is plain: treat everything an agent reads as untrusted, and don't let it run download-and-execute commands without review.
A tampered Claude Code extension in Cursor's marketplace was a separate attack, but it points the same way. Attackers have noticed that AI coding tools run with their owners' permissions. Read AIR's SolanaCry report for the technical details, or Hackread's summary.
