---
type: "post"
id: "air-research-lab-fake-solana-starter-kit-on-14c211"
slug: "air-research-lab-fake-solana-starter-kit-on-14c211"
title: "AIR Research Lab: fake 'Solana starter kit' on GitHub tricks AI coding agents into installing NetSupport RAT (SolanaCry)"
description: "AIR Research Lab reported a malicious GitHub repository presented as a Solana starter kit that can appear in AI coding-agent search results."
retrieval_nugget: "AIR Research Lab reported a malicious GitHub repository presented as a Solana starter kit that can appear in AI coding-agent search results. Its README directs an agent to run a PowerShell downloader that installs remote-access tooling on Windows. The immediate lesson for teams is to treat repository discovery and setup instructions as an execution boundary, not merely documentation."
published_at: "2026-10-30"
updated_at: "2026-10-30"
record_date: "2026-10-30"
date_kind: "published_at"
topics: ["github","coding-agents"]
entities: ["AIR Research Lab","SolanaCry","GitHub","NetSupport Manager","Solana","EVALUSION"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "AIR Research Lab identified a fake Solana starter-kit GitHub repository that steers AI coding agents into installing SolanaCry, a NetSupport remote-access trojan."
prior_refs: []
source_url: "https://hackread.com/fake-github-repo-ai-coding-agents-solanacry-malware"
source_urls: ["https://hackread.com/fake-github-repo-ai-coding-agents-solanacry-malware"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:air-research-lab-fake-solana-starter-kit-on-14c211"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/air-research-lab-fake-solana-starter-kit-on-14c211/","markdown":"https://newruntime.com/posts/air-research-lab-fake-solana-starter-kit-on-14c211.md","json":"https://newruntime.com/posts/air-research-lab-fake-solana-starter-kit-on-14c211.json"}
---

# AIR Research Lab: fake 'Solana starter kit' on GitHub tricks AI coding agents into installing NetSupport RAT (SolanaCry)

## Retrieval answer

AIR Research Lab reported a malicious GitHub repository presented as a Solana starter kit that can appear in AI coding-agent search results. Its README directs an agent to run a PowerShell downloader that installs remote-access tooling on Windows. The immediate lesson for teams is to treat repository discovery and setup instructions as an execution boundary, not merely documentation.

## Summary

AIR Research Lab reported a malicious GitHub repository presented as a Solana starter kit that can appear in AI coding-agent search results. Its README directs an agent to run a PowerShell downloader that installs remote-access tooling on Windows. The immediate lesson for teams is to treat repository discovery and setup instructions as an execution boundary, not merely documentation.

## What happened

Hackread reported on findings by AIR Research Lab concerning malware the researchers call SolanaCry. The delivery vehicle was a GitHub repository, `SolanaUpdateTools/solana-starter-kit`, presented as an open-source Solana decentralized-application template with an Anchor program, a TypeScript client, and a Next.js interface. AIR said the repository was created in November 2025, had 286 stars when it was examined, and ranked first in search results for a Solana starter kit.

The reported distinction is the intended victim path. Rather than relying only on a developer choosing to install a suspicious download, the repository can be surfaced to an AI coding agent that searches for a starter project and follows the repository’s setup directions. Its README instructs the agent to run a PowerShell command using `Invoke-WebRequest` and `Invoke-Expression`. That command downloads and executes a 21 MB file named `indicator.ps1` in memory, a fileless execution route.

According to the report, the script creates a hidden directory under the user’s local application-data folder and extracts 14 files. Thirteen are genuine, digitally signed components of NetSupport Manager, including `client32.exe` and `PCICL32.DLL`. NetSupport Manager is legitimate remote-management software. The remaining file is an attacker-provided `client32.ini` configuration file. The configuration points the installed software to `maxwintodaybtc.com:443`.

AIR’s reported configuration details matter because they describe the post-install behavior. It hides notifications and disconnect options, sends a check-in every 60 seconds, and accepts connections from any IP address. The malware also adds `client32.exe` to the Windows Registry so it runs at user login. The report says it clears Windows Run-dialog command history and deletes the PowerShell installer script after launching the remote-access program.

The researchers found a `RADIUSSecret` value in the configuration that matches signature data eSentire uses for the EVALUSION cluster, which has distributed NetSupport through ClickFix campaigns. They also found the installation-command pattern resembled one from an October 2025 campaign involving fake TradingView AI-signal content and a malicious GitHub repository. AIR explicitly cautioned that the matching value does not establish who operated this campaign. The supplied report did not identify confirmed victims.

## What the archive adds

This is a new event on a known operational-security thread, rather than a restatement. Our earlier note on [AI-powered fuzzing with the GitHub Security Lab Taskflow Agent](https://newruntime.com/posts/ai-powered-fuzzing-with-the-github-security-lab-5bbfca/) described GitHub-packaged agent taskflows for repeatable security work. SolanaCry shows the opposing risk: a repository can also package an instruction path that an agent executes without an adequate trust check.

## Trend signal

This supports the pattern that [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The malicious README is not simply bad text; it becomes dangerous when an agent can turn search output into a PowerShell execution on a developer workstation. Prompt-level cautions are insufficient if the runtime permits unreviewed download-and-execute actions from newly discovered repositories.

## Why now

The report places this campaign in a continuing sequence rather than treating it as an isolated malformed repository. AIR connected the command pattern to a 2025 fake-repository campaign and noted prior demonstrations of coding agents being induced to execute commands or expose repository data. The practical timing is that repository search is becoming part of agent workflows, expanding the value of manipulating rankings, stars, and README instructions.

## Connections to other events

Earlier archive material described “Agent Traps,” where hostile instructions are embedded in the environment an agent reads rather than delivered as conventional prompt injection. This incident is a concrete repository-based version of that exposure: search result, project template, and installation documentation combine into the attack surface. An earlier archive post on SkillSpector also highlighted pre-install inspection of agent skills; the same inspection logic applies to a repository’s setup path and shell commands.

## Why it matters

Teams increasingly ask coding agents to find examples, bootstrap repositories, install dependencies, and run setup commands. That sequence compresses several trust decisions into one apparent convenience action. In this report, a popular-looking template and a single installation instruction are enough to bridge discovery to persistent remote access on a Windows machine.

The useful response is not to prohibit agents from using external code altogether. It is to separate reading from executing. A coding agent can inspect a repository, summarize files, and propose commands, while a person or a constrained approval workflow decides whether a network download, shell interpreter invocation, registry change, or executable launch is allowed. That boundary is especially important on machines holding source code, credentials, wallets, or deployment access.

## What happens next

- **Coding-agent products will add or strengthen approval gates for commands assembled from web or repository content** (6 months, 70%). Watch for: explicit provenance labels and confirmations before networked shell execution.
- **Attackers will continue to use legitimate remote-management components in poisoned repositories** (3 months, 65%). Watch for: additional template repositories whose setup instructions download PowerShell payloads.

## Limits and uncertainty

The available public material is a report about AIR Research Lab’s findings, not an incident report from a named victim or platform operator. It does not establish how many agents encountered the repository, whether an agent autonomously executed the command in a confirmed compromise, or which coding-agent products were exposed. It reports that the repository ranked first in the researchers’ search context, but does not provide a reproducible search methodology or a dated ranking record. The EVALUSION connection is a similarity in configuration data, not attribution. The report also does not establish whether the repository remains available or whether the named domains are still active.

## Skill to build now

Add a “proposed command” gate to agent-assisted setup this week. Require the agent to present the repository owner, the exact command, every downloaded URL, and the expected files before execution. Block or require explicit human approval for PowerShell download-and-execute patterns such as `Invoke-WebRequest` piped or coupled with `Invoke-Expression`, as well as persistence changes such as registry Run keys. Run unfamiliar templates in a disposable environment rather than on a workstation that holds credentials or production access.

## Reader takeaway

A repository README is executable input when a coding agent follows it. Treat search-discovered templates and their setup commands as untrusted until a person or a tightly scoped runtime approves the network, interpreter, and persistence actions they request.

## Open question

Which coding-agent environments can expose the provenance of a shell command and enforce an approval boundary before README-derived instructions reach a developer machine?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- topic hub: [Coding Agents](https://newruntime.com/topics/coding-agents.md): Explore the coding-agents topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)