Live › campaign › CMP-202610-fake-solana-starter-kit-on-github-solanaupdatetools-solana-s
Air Security reports a GitHub repo, SolanaUpdateTools/solana-starter-kit (created November 2025, 286 stars), that ranks as the top result when AI coding agents search for a Solana starter kit. The README is the only file; its only 'installation' step is a Windows PowerShell one-liner that assembles a URL on developer-update[.]app from fragments and fetches and runs a script in memory. The payload (confirmed by BleepingComputer from the Wayback Machine) installs NetSupport Manager configured to connect to maxwintodaybtc[.]com with persistence at every login, then shows a fake error ('developer functionality is temporarily paused due to load... try again in 72 hours') that an agent may relay as a routine hiccup. An agent following the README can run it without the developer seeing it. Linked to a known NetSupport RAT operator tracked by eSentire and an earlier fake TradingView 'AI signal' campaign. Payload URL returned 404 when Air checked; repo still live on Oct 29, 2026. Confirmed victims: unknown. At risk: Windows developers letting Cursor, Claude Code, Copilot, Codex or similar agents run shell commands from READMEs, especially for crypto/Solana projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 22:30 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GitHub | other | – | – |
| Cursor | other | – | – |
| Claude Code | other | – | – |
| GitHub Copilot | other | – | – |
| Solana | other | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("CMP-202610-fake-solana-starter-kit-on-github-solanaupdatetools-solana-s")