Loading story…
Anthropic accidentally exposed roughly 512,000 lines of production source code for Claude Code, and attackers quickly turned the leak into a lure for developers seeking “unlocked” or leaked versions of the tool. Researchers reported malicious GitHub repositories repackaging the exposed material and distributing ZIP archives containing a Rust-based dropper that installed Vidar v18.7 information-stealing malware and GhostSocks proxy tooling. One malicious repository reportedly ranked prominently in Google search results for queries related to leaked Claude Code, increasing the chance that developers would download the payloads, while duplicate repositories under different GitHub accounts were linked to the same actor.
The leak also created a broader security risk by exposing Claude Code’s internal architecture, including system prompt construction, tool definitions, safety boundaries, and anti-distillation mechanisms. Because Claude Code can access file systems, execute terminal commands, and modify development environments, researchers warned that disclosure of the full agentic harness gives adversaries a clearer path to craft prompt injections, evade protections, and audit the codebase for exploitable flaws. Those concerns intensified after a critical vulnerability in Claude Code was publicly reported within days of the source exposure, highlighting how the incident expanded the threat surface beyond malware delivery into direct exploitation of organizations using the tool.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
One malicious GitHub repository briefly ranked highly in Google search results for “leaked Claude Code,” increasing the likelihood that developers would download the malware. The campaign leveraged trust signals around GitHub releases and the leaked Claude Code branding.
After the leak, threat actors created malicious GitHub repositories advertising “unlocked” Claude Code versions and distributing a ZIP archive with a Rust-based dropper. Zscaler linked duplicate repositories under different GitHub accounts to the same actor and observed multiple archive variants delivering Vidar v18.7 and GhostSocks.
Within days of the source code leak, a critical vulnerability in Claude Code was publicly reported. Trend Micro says this showed how the leaked code enabled attackers and researchers to systematically audit the codebase for exploitable flaws.
Anthropic accidentally exposed the source code for its Claude Code tool, leaking approximately 512,000 lines of production code. The leak revealed internal implementation details including system prompt construction, tool definitions, safety boundaries, and anti-distillation mechanisms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors used fake GitHub repositories themed around Anthropic's leaked **Claude Code** source to distribute malware to users searching for the exposed codebase. Researchers at Zscaler ThreatLabz said one repository, operated by user **`idbzoomh`**, promoted a supposed Claude Code leak with "unlocked enterprise features" and no restrictions, while search-engine optimization helped it rank for queries such as **"leaked Claude Code."** Victims who downloaded the offered archive received a Rust-based executable, **`ClaudeCode_x64.exe`**, instead of source code. The executable acted as a dropper for the **Vidar** information stealer and the **GhostSocks** proxy malware. The lure followed Anthropic's accidental exposure of a **59.8 MB** JavaScript source map in an npm package, which revealed roughly **513,000 lines** of unobfuscated TypeScript across **1,906 files** and exposed internal logic and security-related details. Zscaler also identified a second similar repository believed to be tied to the same actor, indicating an ongoing campaign that reportedly reached tens of thousands of users and mirrors recent malware delivery efforts built around fake developer-tool downloads.
Jun 29, 2026
Anthropic accidentally exposed the source code of its Claude Code CLI after publishing npm package version `2.1.88` with a large JavaScript source map that pointed to unobfuscated TypeScript files hosted in company-controlled storage. Researcher **Chaofan Shou** identified the issue, which exposed roughly **1,900 to 2,000 files** and more than **512,000 lines of code** before the package was removed. Anthropic said the incident was caused by a manual release-packaging error rather than an external intrusion, and stated that no customer data or credentials were leaked. The code was quickly mirrored and forked on GitHub, making containment difficult, while Anthropic later acknowledged that automation gaps in its deployment process contributed to the exposure. Analysis of the leaked code revealed internal architecture and unreleased capabilities including **KAIROS** background autonomy, persistent memory features, multi-agent orchestration, hidden feature flags, undocumented commands, and controls intended to resist model distillation or disclosure of internal names. Security researchers warned that exposing Claude Code’s permission logic, trust boundaries, prompts, and execution pathways could help attackers craft jailbreaks, prompt-injection lures, malicious repositories, and persistence techniques against the tool. Anthropic’s response also drew scrutiny after a DMCA notice led GitHub to disable thousands of legitimate forks before the company asked for narrower enforcement, and the leak’s impact was compounded by reports of typosquatted npm packages and a separate compromised `axios` dependency affecting some npm installs during the same period.
Jun 29, 2026
Researchers disclosed multiple security flaws in Anthropic’s **Claude Code GitHub Action** that could let attackers compromise public repositories and expose CI/CD secrets through a single malicious GitHub issue or other untrusted content. One issue, reported by RyotaK of GMO Flatt Security, stemmed from an authorization bypass that trusted any GitHub actor whose name ended in `[bot]`, allowing attacker-controlled GitHub Apps to trigger workflows and inject malicious prompts. Anthropic said the bug could lead to disclosure of environment secrets, including credentials used to obtain OIDC tokens and Claude GitHub App installation tokens with write access, creating a path to repository takeover and broader supply-chain compromise. Microsoft Threat Intelligence separately showed that Claude Code’s `Read` tool was not sandboxed like its Bash tool, enabling access to sensitive runner data such as `/proc/self/environ` and leakage of secrets including `ANTHROPIC_API_KEY`. In lab testing, Microsoft demonstrated prompt-injection attacks that bypassed model safeguards and GitHub secret scanning to exfiltrate credentials through logs, comments, or external channels. Anthropic fixed the authorization issue within days of disclosure and later added hardening in `claude-code-action` `v1.0.94`, while the `/proc` exposure was mitigated in Claude Code `v2.1.128` by blocking access to sensitive procfs files; defenders were urged to treat AI-enabled CI/CD workflows processing untrusted issues, pull requests, and comments as high risk.
Jun 29, 2026