FakeGit: 7,600 Poisoned GitHub Repos Bait AI Agents

Researchers at Island have surfaced a sprawling supply-chain campaign on GitHub: close to 7,600 malicious repositories dressed up as legitimate developer projects, with more than 800 posing specifically as AI skills or Model Context Protocol (MCP) servers. The operation, which they've named FakeGit, has already pulled in over 14 million downloads across roughly 200 active repos, delivering a loader called SmartLoader that then drops the StealC infostealer.

The mechanics are the usual stuff. Attackers clone real projects, stand up lookalike developer profiles, write convincing READMEs, and bundle everything into a ZIP that kicks off a LuaJIT loader chain. What makes FakeGit worth paying attention to is not the malware itself, but the audience.

AgentBaiting: when the mark is the AI

Island calls the twist AgentBaiting, and it lives up to the name. Ask Claude Code, Gemini or ChatGPT to help you "find a free Walmart MCP server" or a cinematic prompt skill for Claude, and the agent will happily surface one of these malicious repositories all on its own. No poisoned search result required. No phishing lure. The AI reads the attacker's README as though it were documentation, and either passes the setup instructions along to the user or, depending on how it's wired up, runs them directly.

That's a meaningful shift. The traditional GitHub-typosquat playbook depends on a distracted human copy-pasting the wrong URL. FakeGit doesn't need the human to be distracted. It just needs the human to be busy enough to trust the agent.

Registries as laundering

Making things stickier, more than 600 of the fake listings have already been indexed by public MCP registries such as LobeHub, Glama, MCP.so and MCP Market. Those directories exist to make agent tooling discoverable, which is exactly what everyone (attackers included) wants. Inclusion in a registry lends the same sheen of legitimacy that a verified badge used to, and both humans and models tend to defer to it.

It's a familiar problem in a new wrapper. The npm and PyPI ecosystems have been dealing with lookalike packages for years. MCP servers and agent skills are the next layer up: the same trust model, applied to code that an AI will pull, read and act on with far less friction than a developer would.

What actually helps

The useful move is to stop treating agent plugins as clever novelties and start treating them like any other third-party dependency.

• Keep an approved catalogue of MCP servers and agent skills your team is allowed to install. Anything outside the list needs a review, not a vibe check.
• Sandbox new integrations before they touch production data or credentials. Agents love to try things. Give them somewhere safe to try them.
• Verify the publisher, not just the repo. A convincing README is cheap. A three-year commit history from a known maintainer is not.
• Log what your agents install and run. If a developer wouldn't be allowed to curl | bash a random script into production, an agent acting on their behalf shouldn't be either.

Agents are eager assistants. That's the whole selling point, and it's also the problem. They will fetch what you ask for, quickly and confidently, and they will not pause to wonder whether the helpful developer behind that shiny new MCP server actually exists.