Roughly 7,600 malicious GitHub repositories, created by about 6,600 profiles, are being used to feed the SmartLoader and StealC malware chain to developers and to AI coding agents that resolve tools on their behalf, according to research from Island summarized by DevOps.com on July 23. About 1,400 of the repos were tailored to AI tooling, and more than 800 posed as Skills or MCP servers. Roughly 200 of them together pulled more than 14 million downloads by the reporting date. For any pipeline whose runners fetch capabilities or MCP servers by name from the platform, that is a fresh attack surface, not a hypothetical.
Island's Oleg Zaytsev, quoted by DevOps.com, framed the agent path plainly: "an agent searching for a new capability can discover a campaign repository on its own, treat the attacker's README as legitimate documentation." Zaytsev's team walked that discovery path against Anthropic's Claude Code, Google's Gemini, and OpenAI's ChatGPT. The AI-focused push ramped up in March and peaked in April, with roughly 300 repositories created that month.
What the payload does
The lure ships a roughly 300 KB heavily obfuscated Lua file, disguised inside the repo as text, an icon, a license, or a data file. That file is SmartLoader; it drops StealC, an infostealer that grabs browser passwords, extension data, cookies, active sessions, screenshots, host information, and email or remote-access credentials from the machine that ran it, per DevOps.com's summary of the Island analysis. On a developer workstation or a CI runner with real tokens mounted, that is a full-fat credential harvest rather than a proof of concept.
Earlier public sightings pointed at overlapping infrastructure. Straiker AI flagged an MCP-ecosystem angle in February, and Derp.ca reported FakeGit distributing Lua malware in March, according to the same DevOps.com write-up.
What Island's defenses actually change
The recommended controls, per the reporting, are unglamorous: evaluate any new capability in an isolated environment before wiring it into a real workflow, verify the publisher and project identity, and monitor the discovery paths your agents actually take. For a pipeline, that is the same posture already imposed on npm install: no fresh, unpinned, name-matched dependency touches a job that holds production secrets. The change is only that the entity typing the install command may no longer be a human.
Top comments (0)