"FakeGit 14 Million Downloads: The AI Agent Supply Chain Repeats npm's History"

The surface headline is 800 fake AI skills. That's the wrong number. The structural number is 7,600 malicious GitHub repositories, more than 14 million measured downloads across about 200 campaign repos, and an entire AI capability discovery mechanism that has no security gate.

Island's July 2026 report documented the FakeGit campaign - roughly 6,600 fabricated developer profiles, 800+ repos posing as AI Skills or Model Context Protocol (MCP) servers, and over 600 listings across public registries including LobeHub, Glama, MCP.so, and MCP Market. The malware chain is SmartLoader followed by StealC, an information stealer that harvests browser sessions, credentials, and tokens.

But the malware payload is not the story. The story is the trust model that let it in.

Decomposition

FakeGit operated in three layers. Understanding the structure explains why this isn't just another phishing campaign.

Layer 1 - Identity fabrication. The campaign created lookalike GitHub profiles. One account, Naveenkm007, differs by one character from the established developer Naveenkm07, mirroring the original profile layout before publishing a malicious MCP server. This is typosquatting applied to developer identity, not just package names.

Layer 2 - Repository cloning. Real projects were copied and modified. Mann1988/awesome-claude-skills replicated the widely used ComposioHQ/awesome-claude-skills repository - which had accumulated 67,000 stars and 7,600 forks - and then added a prominent "Download" badge pointing to a SmartLoader ZIP file. The clone itself had only 63 stars and 18 forks. But a quick visual scan looks plausible.

Layer 3 - AgentBaiting. This is the new mechanism. Island researchers asked Claude Code, Gemini, and ChatGPT to find MCP servers and skills for everyday tasks - "give me a free Walmart MCP server," "find a free claude cinematic prompt skill." All three agents independently discovered malicious campaign repositories, treated attacker-written READMEs as legitimate documentation, and passed installation instructions to the user. No phishing link was required. The agent did the attacker's legwork.

The Ecosystem This Exploits

FakeGit didn't build its lures in a vacuum. It intercepted demand that was already forming.

The AI agent skill ecosystem grew from 5,700 skills on ClawHub in February 2026 to over 44,000 by April. MCP SDK downloads exceeded 97 million monthly across Python and TypeScript. Over 10,000 active public MCP servers are in circulation. OpenClaw - the framework at the center of the skill ecosystem - passed React's decade-long GitHub star accumulation in under five months, hitting 346K stars and 500,000 running instances.

But security governance was absent. The barrier to publishing a skill on ClawHub is a SKILL.md file and a GitHub account one week old. No code signing. No security review. No sandbox by default.

Snyk's February 2026 audit of 3,984 skills found that 13.4% - 534 skills - contained at least one critical-level security issue, including malware distribution and prompt injection. Expanding to any severity level, 36.82% of the ecosystem had security flaws. Koi Security's earlier audit found 341 malicious skills across 2,857 scanned on ClawHub - roughly 12% of the sample was malware.

An AIR experiment in June 2026 demonstrated how easily skills bypass existing controls. A test skill called brand-landingpage passed scanners from Cisco, Nvidia, and skills.sh, then reached over 26,000 users through an Instagram ad. The skill's malicious instruction sat behind a mutable external URL that changed after approval, not inside the submitted package. Point-in-time scanning - the current defense - is structurally insufficient.

62% of the FakeGit AI lures impersonated real enterprise tools: Databricks, Jenkins, Docker, Gmail. They mirrored the exact workflows teams use daily. That familiarity is what made the malicious ZIP files credible.

The Structural Pattern: npm Repeating

This is not a new category of attack. It is an old supply-chain pattern applied to a new trust layer.

Between 2015 and 2020, npm and PyPI - the package managers that became the plumbing of modern software - went through the same arc: explosive growth, near-zero vetting, typosquatting campaigns, malicious maintainers, and post-install scripts used as attack vectors. Then security caught up with provenance verification, automated scanning, and the concept of software bills of materials.

Agent skills are at the same inflection point. The parallels map directly.

Package ecosystem attacks from a decade ago are now agent skill attacks: typosquatting (lookalike profiles and repo names), cloned legitimate projects, post-install setup instructions that trigger payload execution, and public registries listing unvetted content. But agent skills are structurally worse in one dimension: they inherit the full permissions of the AI agent they extend - shell access, file system read/write, environment variables, OAuth tokens - not the sandboxed scope of a typical npm package.

And the attack surface has no analog from the package-manager era: prompt injection. Natural language instructions can embed malicious behavior in prose that regex and static code scanners cannot parse. HKUST researchers demonstrated this with SkillCloak, a system that rewrites suspicious command tokens and credential paths into equivalent forms that agents reassemble at runtime. Their packing technique bypassed every tested scanner more than 90% of the time. The rewriting trick cleared 80% of static scanners and hit 96% on one hybrid tool.

Meanwhile, the behavioral alternative - running skills in a sandbox and watching system calls, as the same team's SkillDetonate tool does - catches 97% of attacks on synthetic payloads and 87% on real-world samples. But it takes 2.5 minutes per skill, versus seconds for static scanning. The speed trade-off matters at scale.

The Capital Flow That Matters

The number to follow is not the malware count. It is the gap between where enterprise security spending is going and where this attack surface lives.

Global cybersecurity spending is projected to approach $244 billion in 2026, a $29 billion year-over-year increase driven largely by AI governance needs (Gartner). The agentic AI cybersecurity sub-segment sits at $2.43 billion and is growing at 31.7% CAGR through 2031. But governance has not reached the skill layer.

Only about 23% of organizations have a formal AI-agent identity strategy. Only 14.4% of agents reach production with full security approval, according to the MCP security survey compiled by Practical DevSecOps. Noma Security's May 2026 whitepaper found that most organizations have governed only MCP servers - the observable, loggable half - while Skills, which load natural-language instructions into a model's reasoning context, remain invisible to traditional security tools.

That gap is where the next wave of security spend flows. NVIDIA announced NemoClaw at GTC 2026 as an enterprise stack adding sandboxing, YAML-defined access policies, and a privacy router. Launch partners included Box, Cisco, Atlassian, Salesforce, SAP, and CrowdStrike. But NemoClaw is one product in what will become a category.

The structural question is not whether agent skills are dangerous. The question is whether enterprises treat them as software supply chain - with version pinning, cryptographic hash verification, runtime monitoring, and allowlisting - or continue treating them as prompts. As cybersecurity researcher Devashri Datta put it after the AIR experiment: "Treating agent skills as mere text or prompts is a fundamental architectural misunderstanding. They are executable instruction bundles."

What to Watch

• Registry governance changes. Whether ClawHub, MCP.so, and LobeHub move from open publishing to vetting, or if the Linux Foundation (which now holds MCP under the Agentic AI Foundation) imposes security standards on registries. The current model is pre-npm-incident, and that will not last.
• Skill scanner evasion rates. HKUST's SkillCloak results - 90%+ bypass for packing, 96% for rewriting on hybrid tools - set a benchmark. Watch whether production scanner evasion stays above 50% or improves. That number determines how useful static scanning is.
• Runtime controls adoption. How many enterprises implement sandboxed skill evaluation before deployment. NVIDIA NemoClaw is the first visible product; the question is how fast the category grows. Behavioral detection tools like SkillDetonate exist but need enterprise packaging.
• AgentBaiting scope expansion. Island tested Claude Code, Gemini, and ChatGPT. As more coding agents gain autonomous search-and-install capabilities - Cursor, Copilot Workspace, IDE-native tools - the attack surface widens. Watch whether AgentBaiting becomes a standard red-team scenario.
• SmartLoader C2 rotation. The campaign uses a Polygon smart contract to store command-and-control server addresses, allowing infrastructure rotation without recompilation. This blockchain-based C2 mechanism means takedowns are temporary. Watch whether operators migrate to other chains or add redundancy.

FakeGit did not breach anything. It published convincing repositories and let agent discovery do the rest. The defenses that matter are the ones that interrupt the chain before execution - not after.