10,000 GitHub Repos Are Quietly Serving Malware to Developers and AI Coding Agents. Is Code Provenance a YC F26 Wedge?

An independent researcher just published a finding that should change how a lot of YC F26 applicants think about security: roughly 10,000 GitHub repositories are quietly distributing Trojan malware, and they have been doing it, undetected, for over a year. The post hit the Hacker News front page this week with nearly 700 points. If you are applying to YC F26 with anything in security, dev tools, or AI agent infrastructure, this is the kind of timely, specific wedge YC partners love to see a founder reason about out loud.

Here is the question worth answering: is securing the code that developers and AI agents pull from the open internet still an open YC F26 wedge, or is it already crowded?

What actually happened

The researcher (writing at Orchid Files) noticed that a fresh repo of his had been cloned. The copy carried all of his commits, listed him as a contributor, and then quietly added a link to a zip archive in the README. Every few hours, the attacker deleted the previous commit and pushed an identical one named "Update README.md."

Using GH Archive, he filtered roughly 16 million commit pushes from the prior five days down to a pattern, then scaled it up. The script surfaced 40,000 candidate repos, of which about 10,000 exactly matched the malware pattern. Each one ships a zip containing a launcher .cmd, a renamed loader .exe, a junk data file, and lua51.dll. The clever part: if you submit the link to VirusTotal, it scans clean. Only the zip itself trips the Trojan detection. An earlier April writeup (Hexastrike) traced the same family, SmartLoader and StealC infostealers, across 109 fake repos. This is the same campaign, two orders of magnitude bigger.

Two design choices matter for founders:

• They clone new, low-traffic repos on purpose. A brand-new repo ranks fast for niche, low-volume search terms. When you Google an obscure tool name, the malicious clone is what surfaces.
• They copy the full commit history and contributor list to fake trust. A visitor sees real contributors with real profiles and a year of history, so the repo looks legitimate.

Why this is suddenly an AI problem, not just a human one

For a decade, the victim of a poisoned GitHub repo was a tired developer at 2am copy-pasting a setup command. In 2026, the victim is increasingly an AI coding agent acting on that developer's behalf.

Agents like Claude Code, Cursor, and the wave of autonomous "build me X" tools now resolve dependencies, clone repositories, and run setup scripts with limited human review. When an agent searches for a library to solve a niche problem, it hits the exact same low-volume search results the attackers optimized for, and it has less skepticism than a human about a repo with a year of fake history. The attack surface that the Orchid Files researcher mapped is the same surface every coding agent now walks across hundreds of times a day.

That is the real F26 angle. The story isn't "GitHub has malware" (it always has). The story is that agentic development just multiplied the blast radius of an old attack, and GitHub's own response, per the researcher, was to delete only the specific repos he reported by hand and ignore the rest.

So is "code provenance" a fundable YC F26 wedge?

Short answer: yes, but only if you pick the sharp version of it.

The crowded version is "we scan dependencies for known vulnerabilities." That space already has well-funded incumbents and existing YC alumni in adjacent lanes (GitLab, YC W15, built a multi-billion-dollar dev platform partly on security; TesterArmy, YC P26, just launched agents that test apps). A generic SCA scanner is not a wedge in 2026.

The sharp version answers a question the incumbents do not: how does an autonomous agent decide whether a repo, package, or command it just discovered is trustworthy, in the half-second before it runs it? That reframes provenance from a dashboard a human reads after the fact into a runtime trust signal an agent consumes before acting. Concretely, fundable F26 angles here look like:

• A provenance/reputation API that an agent calls before cloning or executing, scoring repos on signals the attackers can't easily fake (real download telemetry, maintainer identity continuity, build reproducibility) rather than commit-history theater.
• A sandboxed execution layer so agents can run untrusted setup scripts without handing over the host.
• Detection that catches exactly the pattern Orchid Files found, repos that rewrite the same commit every few hours and inject archive links, which GitHub itself is demonstrably not catching at scale.

What YC partners will actually push on

If you pitch this, expect the interview to go straight at defensibility and distribution, because Anthropic open-sourcing its own AI vulnerability-discovery tooling earlier this month proved the platforms will give a lot of this away for free.

Have answers ready for three things. First, why won't GitHub or the agent vendors just build this? ("They have the data" is the partners' objection; the researcher showed GitHub isn't using its data, but you need a durable reason that holds for two years.) Second, what's your wedge customer? A specific buyer, e.g. teams shipping autonomous coding agents into production, beats "all developers." Third, what do you have running today? Even a script that reproduces the Orchid Files finding live, on this week's repos, is a stronger demo than a deck full of TAM.

The applicants who get interviews out of a news cycle like this are not the ones who say "security is hot." They are the ones who show they already understand the specific mechanism, the trust-faking, the search-ranking exploit, the VirusTotal evasion, and have built the smallest real thing that addresses it.

Pressure-test your angle before you submit

A wedge that sounds sharp in your head can fall apart in the first 30 seconds of a YC interview. Before you write "AI supply-chain security" into your F26 application, it is worth having a YC alum read your one-liner and tell you where a partner will poke a hole, especially on the "why won't the platform build it" question that kills most security pitches.

That is exactly what YC Roaster is for: it connects you with YC alumni who will give you brutally honest feedback on your application and your wedge before the deadline, while you still have time to tighten it. A timely story like this 10,000-repo campaign is a gift for an F26 application, but only if your answer survives contact with someone who has actually sat on the other side of the table.