Claude Code Leak Sparks Malware Surge as Hackers Exploit GitHub to Spread Infostealers Within 24 Hours

CyberDefender 9 mins0

In late March 2026, a seemingly minor packaging mistake triggered a chain of events that quickly escalated into a serious cybersecurity incident. Anthropic unintentionally exposed internal source code for Claude Code through an npm package, and within just 24 hours, threat actors had already weaponized the situation.

This incident highlights a critical reality in modern cybersecurity: breaches are not always the result of sophisticated exploits. Sometimes, simple operational oversights create the perfect opportunity for attackers.

The attack campaign timeline

The Accidental Leak That Started It All

On March 31, 2026, Anthropic published version 2.1.88 of its @anthropic-ai/claude-code package. Due to a misconfigured .npmignore file, a large source map file (cli.js.map) was included in the package. This file exposed approximately 512,000 lines of internal TypeScript code across nearly 1,900 files.

The root cause was straightforward. The build process, powered by Bun, generated full source maps by default. Without explicitly excluding .map files, the entire internal codebase was unintentionally shipped to anyone running npm install.

Within hours, the exposed code was mirrored across GitHub. Although Anthropic quickly removed the package and issued takedowns, the damage had already been done.

From Leak to Weaponization in 24 Hours

Threat actors did not need to deeply analyze the leaked code. What they needed was attention—and the leak provided exactly that.

Within a day, malicious GitHub repositories began appearing in search results for queries like “Claude Code download” and “leaked Claude Code source.” These repositories mimicked legitimate projects and distributed trojanized archives.

The payload? A combination of:

  • Vidar Stealer (v18.7) – designed to extract credentials, browser data, and crypto wallets
  • GhostSocks – a SOCKS5 proxy tool enabling attackers to route traffic through infected machines

These payloads were delivered via large .7z archives hosted on GitHub Releases, a platform typically trusted by developers.

A Much Bigger Campaign Behind the Scenes

The Claude Code lure was not an isolated attack. It was part of a broader, ongoing campaign active since February 2026.

Threat actors had already been rotating through more than 25 software-themed lures, impersonating:

  • AI tools (Copilot, Claude variants, fictional GPT tools)
  • Crypto and trading platforms
  • Media and creative software
  • Utility applications

Despite different branding, every malicious archive contained the same Rust-compiled dropper: TradeAI.exe.

This consistency reveals a mature operation designed for scale. Disposable GitHub accounts were used to repeatedly upload malware, and once taken down, new accounts quickly replaced them.

Infection Chain: How Victims Get Compromised

The attack flow is simple but highly effective:

Victims search for trending tools and land on fake repositories. The repository appears legitimate, often featuring convincing documentation and download links. Once the user downloads and extracts the archive, they unknowingly execute the dropper.

The malware then:

  • Deploys Vidar Stealer and GhostSocks
  • Uses Steam and Telegram profiles as dead-drop resolvers for C2
  • Exfiltrates sensitive data
  • Turns the infected system into a proxy node

This approach blends social engineering with technical evasion, making detection difficult.

Inside the Malware: Designed to Evade and Persist

The Rust-based dropper is engineered with multiple layers of defense evasion:

Anti-Analysis Capabilities

The malware checks for:

  • Virtual machines (VMware, VirtualBox, Hyper-V indicators)
  • Sandbox environments
  • Debugging tools like IDA, x64dbg, Wireshark
  • Suspicious usernames and hostnames

If any indicators are detected, execution stops immediately.

String Encryption

All sensitive data is XOR-encrypted using a rotating 12-byte key. The key can be dynamically loaded via the environment variable: cryptify_keyd3d

Fallback key: xnasff3wcedj

Command-and-Control Infrastructure

Primary URLs:

hxxps://pastebin[.]com/raw/mcwWi1Ue
hxxps://snippet[.]host/efguhk/raw

These are used to fetch payload instructions and additional components.

Defender Evasion

The embedded PowerShell payload disables multiple Windows Defender protections:

  • Behavior monitoring
  • Cloud protection
  • Sample submission
  • PUA detection

It also adds exclusions for critical directories:

C:\Users
C:\ProgramData
C:\Windows
$env:TEMP

And opens inbound ports: 57001, 57002, 56001

This ensures long-term persistence and stealth.

What the Leaked Code Revealed

Beyond the immediate malware campaign, the exposed source code introduces long-term risks.

The leak revealed internal systems such as:

  • KAIROS – autonomous background agent system
  • Dream System – memory optimization engine
  • Undercover Mode – safeguards against accidental data exposure
  • ANTI_DISTILLATION_CC – protections against model replication

It also exposed upcoming model codenames like Capybara, Fennec, and Tengu.

This level of transparency gives attackers a blueprint for:

  • Identifying vulnerabilities
  • Crafting prompt injection attacks
  • Understanding internal safety mechanisms
  • Exploiting agentic workflows

Why This Incident Matters

This incident is not just about a leak or a malware campaign. It demonstrates how quickly threat actors can pivot and exploit real-world events.

More importantly, it shows that human and organizational gaps can be just as dangerous as software vulnerabilities.

Our Perspective on This Incident

What stands out most in this case is not the sophistication of the malware, but the speed and adaptability of the attackers. The threat actors did not need zero-day exploits or advanced intrusion techniques. They leveraged timing, psychology, and trust in developer ecosystems.

The abuse of GitHub Releases is particularly concerning. Developers inherently trust platforms like GitHub, which makes them ideal distribution channels for malware. This shifts the security challenge from technical detection to behavioral awareness.

Another critical takeaway is the growing risk associated with agentic AI systems. The leaked Claude Code wasn’t just another codebase—it represented an operational AI system capable of interacting with real environments. Exposing such systems significantly expands the attack surface.

Organizations must start treating AI tooling as part of their critical infrastructure. Governance, allowlisting, and strict installation controls are no longer optional—they are essential.

Ultimately, this incident reinforces a key principle: cybersecurity is not just about defending systems, but about managing trust.

CyberDefender