On Oct 29 researchers found a fake "Solana starter kit" with 287 stars whose README told AI coding agents to run one PowerShell line, which installed a remote-access trojan. Paste a GitHub repo before you or Cursor, Claude Code or Codex follow its setup steps. Free README check. Nothing is cloned or executed.
Scans the README for download-and-execute one-liners (iwr | iex, curl | sh from unknown hosts), URLs built from string fragments, base64 payloads, known malware domains, password-protected archives and text aimed at AI agents. Also: /api/command to check any single command.
Adds package.json install scripts and typosquatted crypto dependencies, install.sh, setup.py, .vscode/tasks.json autorun tasks, Makefile, and GitHub signals: repo and owner age, stars vs forks/watchers, never-updated repos. 1-3 repos per report, USDC on Base, no gas.
GET /api/basic?repo= free JSON. GET /v1/check?repo=a&repo=b via x402 v2. Remote MCP at /mcp with check_repo and check_command. See openapi.json.