A fake Solana starter kit on GitHub is set up so a coding agent installs a remote-control trojan for you

Security researchers at AIR Research Lab found a GitHub repository posing as a Solana starter kit that is built to catch AI coding agents, not people. A second security newsroom pulled the archived payload itself and confirmed the findings.

What happened

The chain is short. A developer asks their coding agent to build a Solana project. The agent searches the web for a starter kit, and this repository comes up as the top result. It looks the part: created in November 2025, 286 stars, and a description promising a full app template with an Anchor program, a TypeScript client and a Next.js UI. None of that code exists. The README is the only file in the repository.

The README's one and only install step is a Windows PowerShell one-liner. It builds a web address from fragments, downloads a script from it and runs it straight in memory. An agent that follows the README can run it without the developer ever seeing the command.

What the payload does

The recovered script is about 21 MB. It unpacks 14 files into a hidden folder: 13 genuine, signed parts of NetSupport Manager, a legitimate remote-support tool, plus one attacker config file. That config points it at the attacker's server, accepts an operator from any address and switches off the chat, message and disconnect buttons. The script adds itself to the Windows startup list so it runs at every login, starts the tool, clears the Run history and deletes itself.

The result is hidden remote control of the machine: screen, keyboard, files and a remote command shell, plus anything stored on it, including crypto wallets. Then it shows a fake error saying developer functionality is paused due to load and to try again in 72 hours, which an agent could easily pass on to you as a routine server hiccup.

Who's behind it

The researchers tied the config to a known NetSupport operator that another security firm already tracks, and the install one-liner is built the same way, down to the variable names, as an earlier campaign that lured crypto traders with fake 'AI signal' trading tools. Same playbook, new target: first traders, then developers, now the agents working for them.

Where it stands

The payload address was offline when the researchers checked, so they recovered the payload from a web archive. The repository itself was still live on 29 October. Neither report names any confirmed victims. The command only works on Windows, but the trick works the same way against any operating system.

Our take

This is our opinion. Search results and READMEs are untrusted input, even when an agent reads them for you. Don't let a coding agent pick starter templates from search results or run download-and-execute one-liners (iwr | iex, curl | sh) without a human reading them first. Stars are not a security review.