Claude Code Leak Weaponized to Push Vidar Infostealer Malware Through Fake GitHub Repositories
🎙️ Dive Deeper with Our Podcast!
When a major technology company accidentally exposes its source code, the cybersecurity world holds its breath. That window between exposure and containment is precisely when opportunistic attackers strike — and the recent Claude Code leak is proving to be no exception. Within days of Anthropic’s accidental disclosure, cybercriminals had already built a sophisticated malware delivery chain designed to target the exact audience most likely to be searching for that leaked code.
What Happened: The Claude Code Source Code Leak Explained
Anthropic’s Claude Code is a terminal-based AI agent built to execute complex coding tasks autonomously. Unlike typical chat interfaces, Claude Code operates directly inside a developer’s terminal. It handles system interactions, manages LLM API calls, supports Model Context Protocol (MCP) integration, and maintains persistent memory across sessions — making it a powerful but deeply integrated tool.
On March 31, 2026, Anthropic inadvertently shipped a 59.8 MB JavaScript source map inside the official npm package for Claude Code. Developers use source maps to trace minified code back to its original form when debugging. A map that includes private source code can expose that code if it ships in a public package.
The map contained 513,000 lines of fully unobfuscated TypeScript code spread across 1,906 files. This was not a partial peek behind the curtain — it was a full window into the agent’s internal architecture, including orchestration logic, permission structures, execution systems, hidden features, build metadata, and security-sensitive internals.
How Attackers Turned a Leak Into a Malware Campaign
Cybercriminals operate on opportunity. When the Claude Code story began circulating across tech forums, developer communities, and social media platforms, search traffic for terms like “Claude Code leaked source” spiked dramatically. That spike created a perfectly exploitable audience: developers, security researchers, and curious technologists actively looking for the leaked files.
The Fake GitHub Repository Strategy
Researchers at cloud security firm Zscaler identified at least one GitHub repository published under the username “idbzoomh” that posed as a genuine mirror of the Claude Code leak. The repository was anything but legitimate. It advertised itself as offering “unlocked enterprise features” with no usage restrictions — an enticing pitch for developers. This is a classic social engineering technique that managed IT security programs actively train staff to recognize.
The attackers used keyword-rich descriptions and repository metadata to improve visibility in Google Search. According to Zscaler, the repository appeared among the first results for searches like “leaked Claude Code”. As a result, visitors could mistake its search position for evidence of trust.
The Payload: What Gets Installed on Your Machine
The repository prompted users to download a 7-Zip archive. Inside, they found a Rust-based executable named ClaudeCode_x64.exe. The attackers chose a file name that looked legitimate. It resembled a file a developer might expect in a Claude Code package.
Running that executable triggers a dropper that silently installs two distinct tools on the victim’s machine.
⚠ Two-Stage Payload Breakdown
Vidar Infostealer — A well-documented commodity malware strain that harvests saved passwords, browser session cookies, cryptocurrency wallet credentials, credit card data, and autofill entries from installed browsers. Vidar exfiltrates this data to attacker-controlled command-and-control infrastructure.
GhostSocks — A network traffic proxying tool that routes communications through compromised machines, helping attackers mask their identity, bypass geo-restrictions, and evade IP-based detection systems.
The combination is calculated. Vidar generates immediate financial value by stealing credentials. GhostSocks transforms every infected machine into a node in a residential proxy network. Without proactive endpoint protection in place, most organizations would not detect either tool until significant damage had already occurred.
A Constantly Evolving Delivery Mechanism
Zscaler noted frequent changes to the malicious archive. These updates suggest that the attacker was testing or changing the payload. For example, the attacker might add malware or replace components that security tools already detect.
Researchers also found a second GitHub repository with nearly identical code. It showed a “Download ZIP” button, but the button did not work during their analysis. Zscaler believes the same person or group ran both repositories. The researchers suggested that the attacker was testing different delivery methods.
The Broader Pattern: GitHub as a Malware Distribution Platform
GitHub’s reputation as the world’s most trusted software platform is precisely what makes it so attractive to cybercriminals. Millions of developers interact with GitHub repositories daily without questioning their legitimacy. A well-crafted repository — complete with stars, a convincing README, and keyword-optimized metadata — can pass a cursory inspection with ease.
This is not an isolated incident. In late 2025, threat actors ran similar campaigns targeting less experienced researchers by publishing fake proof-of-concept exploit repositories for recently disclosed vulnerabilities. Staying current on these tactics is a core part of Technijian’s managed IT and cybersecurity services.
Event-Jacking: Exploiting Viral News Cycles
Security professionals sometimes call this tactic “event-jacking” — the practice of building malware campaigns around viral news stories to reach a self-selected, highly motivated audience. When someone searches for “leaked Claude Code,” they are already primed to download and execute files. They expect to find something unofficial, possibly hosted outside normal channels. Attackers exploit that lowered skepticism deliberately.
Historically, this pattern repeats with every major disclosure. Leaked corporate documents, major software vulnerabilities, celebrity data breaches, and high-profile open-source incidents all generate predictable surges in search traffic that attackers have learned to exploit efficiently.
Attack Timeline: From Leak to Infection
▸ March 31, 2026
Anthropic publishes Claude Code npm package containing an accidental 59.8 MB source map with full TypeScript source code.
▸ March 31 – April 1, 2026
Developers download and republish the source code. GitHub forks proliferate within hours, generating massive search interest.
▸ Early April 2026
Threat actor “idbzoomh” publishes a fake Claude Code leak repository on GitHub, SEO-optimized to rank for relevant search queries.
▸ April 2, 2026
Zscaler researchers identify and report the malicious campaign, revealing the Vidar and GhostSocks payload combination.
▸ Ongoing
The attacker continued to update the archive during the reported campaign. Researchers also identified a second related repository. At the time of their analysis, the threat remained active.
How to Safeguard Yourself and Your Company
The Claude Code malware campaign succeeds because it bypasses traditional threat indicators. The repository looks credible. The file name sounds legitimate. The pitch — enterprise features for free — is psychologically persuasive. Defense requires both technical controls and organizational awareness.
For Individual Developers
Never download software that claims to offer “unlocked” or “unrestricted” versions of commercial tools. If a source code leak is making the news, obtain any analysis from credible security research blogs and official vendor communications — not random GitHub repositories. Always verify a repository’s age, commit history, contributor profiles, and issue activity before downloading anything. Check out Technijian’s cybersecurity insights for ongoing threat awareness updates.
For IT and Security Teams
Enforce endpoint detection and response (EDR) policies that flag and quarantine unknown executables before they can run. Monitor outbound traffic for known Vidar command-and-control patterns and anomalous DNS lookups. Train development teams to recognize social engineering tactics disguised as technical resources. Treat any executable downloaded outside approved package managers as untrusted by default.
For Organizations Using AI Developer Tools
Establish clear internal policies about how employees obtain and use AI-based developer tools. Require all software to be sourced through vetted channels. When a major AI tool makes headlines — for any reason — alert your team proactively, before someone searches for it independently and stumbles across a malicious repository. Organizations operating under IT compliance frameworks should treat unauthorized software downloads as a reportable security event.
Frequently Asked Questions (FAQ)
Q: What is Claude Code, and why was the leak significant?
Claude Code is Anthropic’s terminal-based AI coding agent. It interacts with system environments, manages API calls and maintains memory across sessions. The leak exposed over 500,000 lines of TypeScript code. That code included internal orchestration logic, permission systems and security architecture.
Q: What does the Vidar infostealer actually steal?
Vidar is an infostealer available on dark web forums. It extracts browser passwords, session cookies and two-factor authentication tokens. It also targets wallet files, saved payment details and autofill data. The malware then packages the stolen information and sends it to attacker-controlled servers within minutes of infection.
Q: What is GhostSocks, and why was it paired with Vidar?
GhostSocks is a proxy tool that routes traffic through infected machines. Vidar steals credentials, while GhostSocks lets attackers use the device as a proxy. Criminals can sell access to these networks or use them to hide the source of later attacks.
Q: How did the malicious repository rank so high in Google Search?
The threat actors deliberately used search engine optimization techniques within the repository itself — keyword-rich titles, descriptions, and metadata — to rank for queries related to the Claude Code leak. GitHub is a high-authority domain, and new content can rank prominently within hours of publication.
Q: Is downloading source code from GitHub always risky?
Not inherently, but risk increases sharply when repositories make extraordinary claims, advertise unofficial versions of commercial software, or appear immediately after a major news event. Legitimate open-source projects have verifiable histories, active contributor communities, and transparent codebases. Always review a repository’s age, commit activity, and issue threads before executing anything you download.
Q: Has Anthropic addressed the source code leak?
Anthropic confirmed the accidental inclusion of the source map in the npm package and acted to address it. However, developers had already downloaded and forked the code across GitHub within hours. This made complete containment difficult. Follow Anthropic’s official security communications for updates.
Q: Could my organization be targeted even without searching for the Claude Code leak?
Yes. Any developer broadly curious about AI tools or performing general research into AI coding assistants could encounter these malicious repositories through search engine results. The SEO optimization used by the attackers means the repository appears for a wide range of related queries, not just highly specific searches for the leak.
Q: What should I do if I already ran a file from one of these repositories?
Immediately disconnect the affected machine from your network. Change all passwords stored in your browsers — especially for banking, email, and cryptocurrency platforms — from a separate, clean device. Contact Technijian’s incident response team right away. Run a full EDR scan and preserve system logs for forensic analysis. The faster you act, the less data is likely to have been exfiltrated.
How Technijian Can Help
The Claude Code malware campaign shows how quickly attackers exploit technology news. Businesses need both technical controls and a clear response process. Technijian can help assess those needs and define the security work within an agreed service scope.
Endpoint Detection & Response: We deploy and manage EDR tools to detect suspicious files and activity. These controls can help identify Vidar droppers, even when the file names look legitimate.
Threat Intelligence Monitoring: Our team tracks active campaigns across platforms including GitHub, dark web forums, and underground markets, alerting you to relevant threats before they reach your employees.
Security Awareness Training: We help your team recognize event-jacking tactics, social engineering disguised as technical resources, and the psychological triggers that attackers deliberately exploit.
Incident Response & Recovery: If an infection has already occurred, our team rapidly contains the damage, removes the threat, recovers affected systems, and documents findings for compliance reporting.
Network Traffic Analysis: We monitor your outbound traffic for known infostealer and proxy tool communication patterns — including Vidar C2 and GhostSocks signatures — catching exfiltration attempts in progress.
AI Tool Governance: We help organizations establish clear, enforceable policies for sourcing and deploying AI developer tools — reducing the risk of employees downloading malicious software.
IT Compliance Support: We help align controls with the frameworks your organization follows. This includes a process to detect, document and assess unauthorized software events.
Threats like this change quickly. During the reported campaign, attackers updated the malicious repositories with new payloads. Monitoring and staff awareness can help identify such risks. Technijian works with businesses across Southern California and beyond to plan those controls.
Ready to strengthen your defenses? Schedule a free IT security assessment or visit technijian.com/contact-us to speak with our team today.
