Clean GitHub Repo Attack Coaxes AI Coding Agents Into Running Reverse Shells

Mozilla’s 0DIN researchers demonstrated a supply-chain-style proof of concept in which an AI coding agent such as Claude Code can be manipulated into compromising a developer’s machine while cloning and initializing a seemingly benign GitHub repository. The repository itself can appear clean, with a legitimate-looking README and no obviously malicious code, but a staged setup flow causes a package to fail until initialization and prompts the agent to run follow-up commands it interprets as routine recovery steps.

In the demonstrated chain, an initialization script fetched attacker-controlled data from a DNS TXT record and executed it, with the TXT record carrying a base64-encoded reverse-shell payload that could give the attacker interactive access under the developer’s privileges. Researchers warned that such access could expose environment variables, API keys, local configuration files, source code, documents, browser sessions, passwords, and enable persistence, while remaining difficult for scanners, human reviewers, and AI agents to detect because each step appears normal in isolation. They said threat actors could distribute these repositories through fake job offers, tutorials, blog posts, or direct messages, and urged agentic tools to reveal the full execution chain, including dynamically fetched scripts and runtime code.