SolanaCry Turns AI Coding Agents Into RAT Installers.

SolanaCry shows that agent browsing and execution have become a software supply-chain attack surface: a convincing search result can turn an AI assistant into malware delivery infrastructure.

• –The repository had 286 stars and a credible dApp-template description, giving agents strong signals to trust it.
• –Its only setup step used obfuscated `iwr` plus `iex` to download and execute code directly in memory.
• –The payload bundled 13 signed NetSupport components with an attacker-controlled configuration, persistence, and remote-control infrastructure.
• –Any coding agent that searches the web and can run shell commands is exposed to this pattern; the recovered payload specifically targets Windows.
• –Developers should require approval for download-and-execute commands, sandbox agent installs, and use pinned, manually vetted templates.