FakeGit

A pseudonymous researcher at Orchid Files discovered roughly 10,000 trojan repositories on GitHub that were clones of their own project with malicious download links. GitHub deleted all 10,000 within …

Island uncovered roughly 7,600 malicious GitHub repositories, more than 800 of them posing as AI Skills or Model Context Protocol (MCP) servers, in a wave that peaked in April 2026, with the fake repo…