SolanaCry: a fake "Solana starter kit" on GitHub is the top result when coding agents search for one, and its README tells the agent to run a PowerShell one-liner that installs a NetSupport RAT
AIR Security found SolanaUpdateTools/solana-starter-kit on GitHub (created November 2025, 286 stars). It describes a full Anchor/TypeScript/Next.js template, but the README is the only file. Its only "installation" step is a PowerShell command that builds a URL on developer-update[.]app from fragments and runs the downloaded script in memory (iwr plus iex).
- Payload: genuine, signed NetSupport Manager 12.10 files plus an attacker config pointing to
maxwintodaybtc[.]com:443, with user-facing warnings and disconnect options turned off and a Run-key entry for persistence. It then shows a fake "developer functionality is temporarily paused due to load, try again in 72 hours" error, which an agent may simply report back as a server hiccup. - Why agents: AIR says the repo ranks first when an agent searches for a Solana starter kit, so a developer who asks an agent to "build a Solana app" may never see the command. AIR links the operator to a known NetSupport RAT actor tracked by eSentire and an earlier fake TradingView "AI signal" lure. The payload URL returned 404 when AIR checked; the repo was still live on Oct 29.
What to do: require approval before coding agents run shell commands, and block piped download-and-execute patterns (iwr | iex, curl | sh) from READMEs; don't let agents choose templates from search results unreviewed. Block both domains, and on Windows dev machines look for NetSupport client32.exe running from a hidden folder under %LOCALAPPDATA% and unfamiliar HKCU Run entries. If found, isolate the machine and rotate credentials and wallet keys that were on it.
Sources: AIR Security: SolanaCry, agents searching the internet attacked by malware in the wild (Oct 29) · BleepingComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining (Oct 29)