14 Million Downloads Later: Inside FakeGit, the AI Agent Poisoning Campaign That Uses Polygon as Its Kill Switch

The developer had done everything right. Hardware wallet. YubiKey. A password manager generating unique credentials for every service. None of it mattered. Their AI coding assistant — the one that searches public registries for useful tools — recommended a repository with a credible name and a respectable star count. One click to install. A ZIP file unfurled. A LuaJIT loader slipped past every antivirus signature on the machine. Then the payload quietly dialed home to a smart contract sitting on Polygon, pulled its next instructions, and made off with SSH keys, OAuth cookies, and session tokens. That developer is not alone. Security firm Island has been tracking this operation under the codename FakeGit, and it has grown into one of the largest AI supply-chain poisoning campaigns I have seen in nearly three decades of watching this industry. Not because of sophistication. Because of sheer reach. The numbers are brutal: roughly 7,600 malicious GitHub repositories, about 6,600 malicious configuration files disguised as AI skills and MCP servers, and more than 14 million downloads across at least 200 of the most successful malicious repos. Fourteen million. Let that sink in. This is the story of how AI agents became unwitting accomplices in their own ecosystem's compromise — and why the blockchain at the center of the command-and-control channel might end up being the attacker's biggest mistake. MCP, the Model Context Protocol, was supposed to be the great connector. It lets AI assistants discover tools, fetch skills, and integrate plugins from public registries without tedious manual configuration. Claude Code, Gemini, ChatGPT — they all lean on this discovery layer to extend what they can do. The dirty secret of that layer is that it was built for velocity, not verification. Say 'use this database tool' or 'deploy this debugging skill,' and the agent will often just fetch it. No security audit. No maintainer history check. It reads signals — stars, forks, download counts, README polish — and assumes the ecosystem has already vetted the package. That assumption is exactly what the FakeGit operators weaponized. They call it AgentBaiting: the systematic poisoning of the discovery mechanisms that agents trust implicitly. LobeHub, Glama, MCP.so, and MCP Market all became distribution fronts, each one amplifying poisoned listings into the recommendation indexes that agents query in real time. As the tech world races to integrate agents into production pipelines, this trust default is becoming the defining vulnerability of the software supply chain — a level below the dependency chain, in the recommendation layer itself. Let me walk through the attack chain, because the deliberate ugliness of it deserves attention. Malicious repository → fabricated ZIP → LuaJIT loader → SmartLoader → Polygon smart-contract C2 → StealC infostealer. That is the full pipeline from trust to theft, and every stage is either cheap or deniable. First, the borrowed identities. The attackers did not create fresh GitHub accounts and hope for traction. They took over or mirrored the profiles of real developers — credible humans with commit histories and followers. That single decision gives the social engineering enormous lift. Based on my audit experience, this is also where detection gets hard: a poisoned repository shielded by genuine identity history is nearly indistinguishable from a legitimate project at the registry level. Second, the amplification loop. Island researchers found malicious listings on LobeHub, Glama, MCP.so, and MCP Market simultaneously. These registries mirror each other, so a listing seeded in one spreads to the others without manual intervention. Cleanup is not a sprint; it is a year-long siege. Third — the part that should terrify any team running agents in production — the measurements. Island's researchers tested whether the top models would actually recommend the poisoned packages. Claude Code recommended a malicious skill repo. Gemini recommended a malicious MCP server. ChatGPT recommended one too. The models cannot distinguish a poisoned repository with synthetic social proof from a legitimate open-source project. Here is the piece most write-ups are missing: those stars and forks were likely manufactured. Search ranking and agent recommendation both rely on community signals as proxies for quality — and quality is being gamed at industrial scale. If an agent weighs community approval as a proxy for safety, then anyone who can fabricate approval owns the recommendation engine. It also means the impact is unevenly distributed: roughly 200 repositories accounted for the entire 14-million download count, an average of 70,000 downloads per poisoned repo. That ratio tells you how effective the recommendation layer really is — and how blind the defense remains. Then comes the Polygon layer. Choosing Polygon for command-and-control was not random. Gas costs are near-negligible, so deploying hundreds of C2 contracts costs hundreds of dollars, not millions. Polygon's high transaction volume means C2 heartbeat commands drown in ambient noise — no suspicious IP blocks, no flagged URLs, just routine smart-contract reads. EVM compatibility means the tooling is abundant and mature. From a cost-versus-obfuscation standpoint, it is the optimal harbor. SmartLoader is worth dwelling on. It does not need to be sophisticated; it just needs to survive long enough to establish contact with the chain. The LuaJIT loader that precedes it is chosen for its low detection rate — a compiled Lua runtime is an unusual execution context that traditional antivirus engines do not inspect deeply. Once SmartLoader reaches the Polygon contract, it reads orders directly from chain state. The attacker does not need to maintain a persistent server to control the bots. They simply update the contract, and every implant receives new orders on its next scheduled check-in. It is a living kill switch, stateful and censorship-resistant in ways a traditional server never could be. The final stage, StealC, targets the highest-value items on a developer's machine: SSH credentials, OAuth tokens, browser session cookies. This is the detail security teams keep under-emphasizing. Cookie theft breaks MFA. An attacker holding a valid session token does not need your password, does not need your 2FA code, and does not trigger a single login alert. Rotating passwords after this kind of compromise is theater. You must rotate tokens, revoke OAuth grants, invalidate every session. There is a real chance the same group is connected to Trend Micro's Water Kurita tracking, which abused a similar LuaJIT loader with Lumma Stealer. The loaders differ, but the operational signature — registry seeding, borrowed identity, chain-level C2 — smells like an evolving playbook by a resource-rich underground organization, not a lone hobbyist. Here is the counter-intuitive take that most security commentary is missing: the smart-contract C2 is the attacker's biggest structural liability, not their cleverest asset. Every command sent to a SmartLoader implant over Polygon leaves a permanent, public, auditable trail. Traditional HTTP C2 servers die the moment someone sinks a domain. A blockchain C2 cannot be sunk. It can only be watched. Once a researcher identifies the contract address, they can reconstruct the entire command history, map infected clusters, trace gas-funding wallets, and detect timing patterns. The same immutability that made Polygon attractive as a 'quiet' channel becomes a forensic goldmine for the defense. A blockchain C2 cannot be sunk. It can only be watched. There is a second blind spot hidden here. This is not really a crypto attack. It is a trust-inertia attack that happens to use crypto as plumbing. No Polygon vulnerability exists here; no DeFi logic flaw was exploited. If the security community frames this only as 'blockchain misused for crime,' we will miss the harder lesson. The real crack is that AI agents hold unearned authority over the supply chain — identical to the way governance participants delegate their votes to KOLs without doing homework. The laziness is the vulnerability. The delegation is the exploit. And if this playbook spreads — and it will — expect copycats across Solana, Base, and Ethereum, all using the same 'recommendation-is-trust' mechanic against an agent world that is still not ready to verify anything it adopts. The next six months will define an entire security category. Watch for MCP firewalls, agent-behavior monitoring, AI supply-chain SBOMs, and curated registry approval lists. The model providers — Anthropic, Google, OpenAI — have been put on notice. Their agents need a security layer they were never shipped with. As for your own assets — your crypto keys, your CI/CD tokens, your session cookies — assume the exposure window is wider than you think. Rotate tokens. Revoke OAuth grants. Sandbox every repo your agent recommends. The chaos arrived wearing a helpful repository's face, polished README and all. The counter is already being built on the same chain the attackers chose for cover. The fork in the road where code met chaos and won — that fork is yours to choose.