Fake Solana starter kit distributes a NetSupport backdoor through README install instructions
Air Security analyzed a fake GitHub starter kit whose README downloads a PowerShell payload and installs remote access on Windows. The repository dates to 2025; the October 29 disclosure highlights exposure through coding-agent searches. Confirmed victim counts are unavailable.
- Disclosed
- Oct 29, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Windows developers or coding agents that executed the install command from SolanaUpdateTools/solana-starter-kit
- windows
- In the wild
- Unknown
- Recovered malware was analyzed; real-world infections are not quantified.
What happened
This is a malicious repository, not a compromise of the legitimate Solana project or of GitHub itself. Its README advertises application code that is absent and supplies an obfuscated download-and-execute command instead. Air’s recovered payload installs genuine NetSupport Manager components with attacker-controlled configuration and login persistence.
The researcher demonstrated a viable route from an agent selecting a search result to executing the repository’s instructions. That does not show that every coding agent follows those instructions or establish a victim count. L3 reflects the publicly documented delivery chain and its relevance to developer workflows. The original payload URL returning 404 does not establish that a previously exposed machine is clean.
Crime-scene timeline
Oct 29, 2026
Air Security publishes its analysis of the recovered PowerShell payload
~Nov 2025
The malicious starter-kit repository is created
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Air Security SolanaCry researchPrimaryAnalyzes the archived payload, Windows-only execution path, persistence and C2; reports the delivery URL was offline when checked.
- BleepingComputer independent payload checkSeparately recovered the archived payload and confirmed its remote-access behavior.