Manufactured credibility meets AI-assisted discovery (Island)

Attackers faked the stars, forks and commit histories of 88 GitHub repositories. ChatGPT and Google then recommended one of them.

Security firm Island investigated a malware campaign delivering a remote access trojan through poisoned npm dependency chains, and found the repositories had been dressed up to look established: real functionality preserved, fabricated development histories, automated fork activity. The researchers took one, an unaffiliated Shopify integration, and asked ChatGPT in a fresh logged-out session for the best options. The campaign repository appeared among the top recommendations. Google AI Overview surfaced it too.

This is search engine optimisation rebuilt for a new audience. For twenty years, bad actors gamed the signals that humans and crawlers relied on. Now the target is the model that tells a developer what to download, a buyer which supplier to trust, an employee which answer is correct.

The uncomfortable part is that the gamed signals are the same ones we taught ourselves to trust: popularity, activity, apparent history. A model reading those signals at scale is not sceptical. It is efficient.

Island is honest about the limits of its own finding. It cannot say which signal caused the recommendation, or whether the campaign set out to influence AI at all. What it shows is narrower and still uncomfortable: manufactured credibility is exactly what AI-assisted discovery reads.

For anyone selling into an AI-mediated market, there is a mirror lesson. Your reputation is increasingly read by machines, and so is your competitors'. Provenance you can prove will soon be worth more than popularity you can display.

For organisations, the shape of supply-chain risk has changed. Procurement controls and software allow-lists were designed for people who might be fooled occasionally. They now guard an intermediary that can be fooled systematically.

Who checks what your AI recommends before someone acts on it?

#Cybersecurity #SupplyChain #AusBiz

Source: Island, 13 October 2026: https://lnkd.in/gxyMUt85