Hackers are turning the Claude Code source leak into an active malware-delivery channel, using GitHub Releases to push the Vidar stealer and GhostSocks under the guise of “leaked” Anthropic tooling.
The incident shows how human and governance failures around AI development can rapidly cascade into both traditional compromise and new agentic-risk exposure.
The 59.8 MB file exposed roughly 512,000 lines of internal TypeScript across about 1,900 files, effectively publishing the full Claude Code agentic harness via a misconfigured .npmignore and Bun’s default full sourcemap behavior.
Within hours, mirrors of the leaked code proliferated across GitHub, forcing Anthropic to pull the package, issue DMCA takedowns, and confirm that the incident was caused by human error rather than an external intrusion.
In late March 2026, Anthropic accidentally shipped a massive JavaScript source map (cli.js.map) with version 2.1.88 of its @anthropic-ai/claude-code npm package.
Threat actors did not need the code to build an exploit chain they needed the visibility. Within 24 hours of the leak drawing widespread attention, they began seeding GitHub with fake “leaked Claude Code” repositories offering trojanized archives to users searching for the exposed source.
Security researchers tracking the campaign observed malicious repositories promising “Claude Code leak” downloads that delivered large 7z archives through GitHub Releases.
Inside these archives, a Rust‑compiled executable (variously named ClaudeCode_x64.exe, TradeAI.exe, and other brand-aligned variants) acts as a loader that drops Vidar stealer alongside GhostSocks proxy malware.
Vidar focuses on high‑value theft, including browser credentials, cryptocurrency wallets, session tokens, and detailed system information.
GhostSocks converts infected machines into SOCKS5 proxies, giving operators residential‑like infrastructure to blend malicious traffic with legitimate user activity.
The operators rotate disposable GitHub accounts and lure names, abusing the perceived trust of GitHub Releases while regularly rebuilding repositories to sidestep takedowns.
The Claude Code angle is only the most recent lure in a broader rotating campaign that has been active since at least February 2026.
Earlier phases impersonated a mix of AI tools, trading utilities, creative software, and general-purpose utilities, with each 7z package ultimately delivering the same Rust‑compiled infostealer dropper.
Trend Micro’s analysis links this activity to a wider pattern of OpenClaw‑style GitHub lures that previously used fake AI installers to spread GhostSocks and related infostealers.
Search‑driven discovery is central to the infection chain. Users who query phrases like “leaked Claude Code source,” “Claude Code download,” or similar AI‑tool keywords encounter convincing repositories with minimal READMEs, fake download buttons embedded as images, and release assets sized to resemble legitimate software distributions.
Once executed, the loader performs extensive sandbox and VM checks, then proceeds to deploy Vidar and GhostSocks while using encrypted configuration and multi‑stage scripts to disable Windows Defender and open firewall ports for command‑and‑control traffic.
Beyond functioning as an effective lure, the leaked Claude Code base introduces a durable risk. Public access to a production‑scale agentic CLI exposes patterns that can accelerate vulnerability research against tooling that interacts directly with developer environments.
Researchers and adversaries can mine the 512,000‑line codebase for privilege escalation paths, arbitrary code‑execution bugs, or weaknesses in how the agentic scaffolding handles file operations and tool invocation.
The source tree also reveals how Claude Code structures system prompts, tool definitions, and safety logic, effectively providing a blueprint for targeted prompt‑injection and safety‑bypass attempts.
In addition, Anthropic’s anti‑distillation mechanisms designed to prevent competitors from training on API traffic are now documented in detail, allowing sophisticated adversaries to design ways around signature checks and canary tools.
Mitigation needs to address both classic malware exposure and emerging agentic risk. Organizations should restrict installation of AI developer tools like Claude Code to official channels and package managers, treating unofficial GitHub repositories and standalone installers as high risk.
Security teams should increase scrutiny of GitHub Releases, flagging newly created repositories that host large archives and show minimal development history, and should block known Vidar and GhostSocks indicators at the network and endpoint layers.
This incident underscores that compromise pathways increasingly flow through human and governance gaps, not just software flaws.
TrendAI’s Agentic Governance Gateway positions governance as the control plane for agentic AI, helping organizations discover and inventory agents, observe and understand their behavior, detect anomalous or unsafe actions, and enforce policy over autonomous decision‑making.
In parallel, TrendAI Vision One integrates detections for the Vidar and GhostSocks IOCs in this campaign and provides customers with curated threat‑hunting queries, insights, and intelligence to trace activity tied to these GitHub‑delivered payloads.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…