Five checks you can do by hand in five minutes — and the extension that does them on every page, before the download.
The short answer. Nobody can tell you a repository is safe, and a tool that says so is overclaiming. What you can tell, in five minutes, is whether it is trustworthy enough to download: who published it and since when, whether its popularity matches its history, what is attached to its releases, what runs the moment you open it, and whether an AI assistant sent you. In 2026 those five questions catch the campaign that matters.
The FakeGit campaign published roughly 7,600 repositories from about 6,600 fabricated accounts. The payload was not in the source tree; it was a ZIP attached to a release, and those were downloaded 14,084,688 times — every one of them through a browser. Over 800 of the repositories posed as AI Skills or MCP servers so that Claude, Gemini and ChatGPT would recommend them unprompted. None of this required a phishing link. It required a developer to look at a repository, believe it, and press Download.
1. How old is the owner's account? Open the profile. The Joined date is under the avatar. An account created in the same month as the repository, with nothing else on it, is the FakeGit shape — 6,600 times over. Years of unrelated history are hard to fabricate.
gh api users/OWNER --jq '{created_at, public_repos, followers}'2. Do the stars match the history? Stars are a purchased commodity — CMU's ICSE 2026 study identified around 6 million suspected fake ones. Hundreds of stars on an account under a year old, or a star count that outruns the repository's age by twenty a day, is traction without provenance.
3. What is attached to the releases? Open the Releases tab and read the asset names. A library whose releases are .exe or .zip files with no matching source tag deserves the question why. This is the delivery path in 211 of the campaign's repositories.
gh release view --repo OWNER/REPO --json assets --jq '.assets[].name'4. What runs before you read a line of code? A checked-in .devcontainer runs a command on the host when the folder opens; .vscode/tasks.json runs on workspace trust; build.rs runs when rust-analyzer starts; setup.py runs on pip install .; a nested bare repository can run commands on ordinary git operations. Read the file list before you open the folder in an editor.
gh api repos/OWNER/REPO/git/trees/HEAD?recursive=1 --jq '.tree[].path' | grep -E '^(\.devcontainer/|\.vscode/|build\.rs$|setup\.py$|\.envrc$|\.gitmodules$)'5. Where did the link come from? If an assistant recommended the repository, it performed a search, not a review. It read a README the publisher wrote and ranked it on relevance to your question. The technique of seeding repositories so that assistants find them is called AgentBaiting, and the rule for it is blunt: verify the publisher out of band before you install anything an assistant handed you.
It asks them — and seventeen more — on every GitHub repository page you open, and shows a 0–100 score beside the repository name with the reasons one click away. The 22 checks have published weights and measured false-positive rates: a maintainer account under 90 days old costs 45 points and blocked none of the top 100 repositories in our controls; a binary release asset costs 10 and warns, because 95% of legitimate tools that ship a program fire it. If you press Download on a repository that fails your policy, the download is held while the verdict is fetched and cancelled before it reaches your downloads folder. And because the extension runs in the browser, it is the only tool that can see the fifth question at all: that an AI surface led you here.
| Verdict | What it means | What happens |
|---|---|---|
| PASS | No check fired at a level your policy acts on. Not a guarantee. | The download proceeds. |
| REVIEW | Findings worth reading — a young account, an auto-executing devcontainer, no licence. | The download is held and the findings shown. Proceeding is your choice, and recorded on your machine. |
| BLOCK | A finding your policy blocks on, or a repository on an active campaign list. | The download is cancelled before it reaches your downloads folder. |
| Gated | Not seen |
|---|---|
| The Download ZIP button | git clone, gh repo clone |
| Release-asset archives and installers — the FakeGit path | npm install, pip, go get, curl |
| Save Link As and pasted archive URLs | Docker builds |
| A repository an AI assistant led you to — the one signal only the browser can see | An AI agent that fetches code on its own |
A browser extension cannot observe processes outside the browser. That is structural, and we would rather print it here than let you find it out. What it does cover is the path the campaign actually used.
Can a tool tell me a GitHub repository is safe? No, and one that says so is overclaiming. What can be measured is trustworthiness: who published the repository and since when, whether its popularity matches its history, what is attached to its releases, what runs the moment you open it, and whether an AI assistant sent you. RepoGates scores those 22 signals with published weights and measured false-positive rates. A PASS means none of them fired at a level your policy acts on — not that the code is good.
Does RepoGates stop git clone? No. RepoGates gates browser-initiated downloads — Download ZIP, release-asset archives, Save Link As. It does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. A browser extension cannot observe other processes. Inside Claude Code with the RepoGates plugin, a hook refuses a clone or install that names a blocked repository on the command line, before it runs — it sees Bash tool calls in that one client and nothing else.
What does RepoGates send about me? The repository name, as owner/repo, and nothing else — no page URL, no file contents, no browsing history. If an AI surface led you to the repository, the hostname of that surface is sent with the verdict request, never the conversation.
Add RepoGates to Chrome or Edge How the 22 checks work
Free to start: 10 repositories within 14 days, no card. Personal is $29 a year. Numbers on this page: Island and BleepingComputer, July 2026; our own Phase 0 measurement of 14 August 2026 — including the correction that made our number smaller.