Malicious SolanaUpdateTools/solana-starter-kit GitHub repository reached agents through search ranking (SolanaCry): remove the implant and rotate wallet keys

View raw markdownEdit on GitHub ↗

TL;DR

If a coding agent or a developer on a Windows machine ran the install step from the SolanaUpdateTools/solana-starter-kit GitHub repository, remove the staging folder and the Run key it leaves, then rotate every wallet key, credential and token that was on the machine. The repository returned 404 on 2026-11-05; the operator has reused the same lure pattern against other audiences and new repositories are likely.

Packages and versions

Ecosystem Name Bad versions Clean version or action Registry state (date checked) Record
GitHub SolanaUpdateTools/solana-starter-kit the repository as a whole (created 2025-11, 286 stars at analysis); its README's only install step downloads and runs remote content do not clone or install; treat any copy as hostile github.com returned 404 for the repository (2026-11-05) none: not a registry package, no GHSA, no OSV record

The status is unconfirmed because AIR Security is the only firm to have analysed the repository and its payload; The Hacker News lists the finding in its 2026-11-05 roundup from the same post. AIR Security says the payload URL was offline when it checked and the payload was recovered from a web archive.

Am I affected?

Windows only. AIR Security lists what the installer leaves:

  1. A hidden staging folder %LOCALAPPDATA%\y2inwRnI6G holding 13 NetSupport Manager components, among them client32.exe and several DLLs, plus an attacker-supplied client32.ini.
  2. A Run value named SecureModule under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that starts client32.exe at every login.
  3. The installer clears the RunMRU history under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer and deletes its own script, so an empty recent-commands list on a machine that ran a PowerShell install step is itself a signal.
Get-ChildItem "$env:LOCALAPPDATA\y2inwRnI6G" -ErrorAction SilentlyContinue
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name SecureModule -ErrorAction SilentlyContinue
Get-Process client32 -ErrorAction SilentlyContinue | Select-Object Path
  1. Check the agent's transcripts: a Claude Code (or other agent) session that was asked to build a Solana project and fetched or cloned solana-starter-kit, or ran a PowerShell command from its README, is the path AIR Security demonstrated. The developer never had to approve the command for the agent to follow the README.

If you are affected

  • Disconnect the machine from the network. Remove the staging folder and the SecureModule Run value, then reboot and confirm client32.exe is not running. NetSupport Manager is a legitimate remote-control product, so an endpoint scanner may not flag it; the folder name and the Run value are the indicators.
  • Rotate every cryptocurrency wallet key, seed phrase, exchange API key, cloud credential, Git token and session cookie that was on the machine, in that order. See rotating cloud credentials and if your local AI agent was exploited.
  • Move funds out of any wallet whose key was on the machine before rotating anything else.

Prevention

  • Treat everything an agent reads, including search results, READMEs and documentation, as untrusted input, and require review before an agent runs a command that downloads and executes remote content. See agent sandboxing.
  • A high search rank is not provenance. Vet a repository before an agent installs from it: package vetting checklist.
  • Expect the pattern to recur under new names; AIR Security says the operator changes lures often and used the same install-command pattern against traders in a campaign documented in 2025-10.

Sources