Campaign scale: ~7,600 malicious repositories, 800+ posing as AI skills or MCP servers (Source: The Hacker News (July 2026))
The Repositories Looked Legitimate
Security researchers discovered nearly 7,600 malicious GitHub repositories as part of an ongoing campaign dubbed FakeGit. Over 800 of those repositories specifically impersonated artificial intelligence tools or Model Context Protocol (MCP) servers — the exact infrastructure that developers are building and integrating right now. The repositories delivered a malware family called SmartLoader.
Why MCP Servers Are the Perfect Trojan Horse
The Model Context Protocol is designed to let AI agents connect to external tools and data sources. An MCP server is, by definition, a piece of software that an AI system trusts to execute actions on its behalf. When a developer installs a malicious MCP server, they are not just running untrusted code on their machine. They are granting that code the execution context of an AI agent — access to files, APIs, databases, and whatever else the agent is configured to reach.
This is supply chain poisoning adapted for the AI era. The attack vector is not a compromised npm package or a typosquatted PyPI module. It is a fake MCP server that looks like a useful AI integration, gets installed by a developer building AI workflows, and runs with the permissions of the AI agent itself.
The Scale Problem GitHub Cannot Solve Alone
7,600 repositories is not a targeted attack. It is an industrial operation. The campaign creates repositories at volume, each with enough plausible structure — READMEs, directory layouts, configuration files — to pass a quick visual inspection. GitHub's abuse detection systems catch some of these. But the economics favor the attacker: creating a repository is free and automated, while detection requires analysis of code behavior, not just metadata.
The 800+ repositories specifically targeting AI and MCP developers represent a strategic choice by the attackers. They are targeting the developers who are building the next layer of web infrastructure — the developers whose machines have access to API keys, cloud credentials, model weights, and production deployment pipelines. Compromising one AI developer's workstation can provide access to the entire stack they are building.
What This Means for the AI-First Web
The machine-to-machine web runs on trust relationships between software components. MCP is one of those trust relationships. When an AI agent calls an MCP server, it trusts that server to return accurate data and execute actions faithfully. The FakeGit campaign demonstrates that the trust bootstrapping problem — how do you know the MCP server you installed is the one you intended? — is already being exploited at scale.
WebPulse tracks 30 web frameworks and their security postures. But the Astro and Next.js and Hugo installations those frameworks power are only as secure as the supply chain that assembles them. A modern web application built on a zero-CVE framework, deployed on hardened infrastructure, can be fully compromised if the developer who built it installed a malicious MCP server on their development machine three weeks earlier.
Practical Defenses
Audit every MCP server and AI tool integration in your development environment. Verify the source repository against the official project. Check commit history — legitimate projects have organic development histories, not a single bulk commit. Use lockfiles and pinned versions. Treat MCP servers with the same security scrutiny you would apply to a production dependency, because that is exactly what they are.
