Claude Code Executes Hidden Malware the Moment It Opens a GitHub Repo
> Published: 2026-06-29 · Category: Research / Security > Source: The Decoder — Claude Code runs a GitHub repo's hidden malware without verification, giving attackers full control
What Happened
On June 29, Mozilla's GenAI vulnerability bounty platform 0DIN published research describing a new attack path that can grant an attacker full control of a developer's machine the moment Claude Code opens a seemingly normal GitHub repository.
The attack chain:
1. The attacker builds a professional-looking GitHub repo with a clean README, tests, and documentation.
2. The repo contains a setup script (setup.sh / install.sh / a Makefile) with a command—but the critical part is not in the repo; it lives in a DNS record.
3. A developer opens the repo with Claude Code, which hits an ordinary-looking error during the setup phase.
4. Claude Code automatically runs the setup script to "fix the error"; the script queries DNS, retrieves the real malicious payload, and executes it.
5. The payload opens a reverse shell, giving the attacker control—harvesting API keys, login credentials, and SSH keys, and maintaining persistent access.
The key point: the malicious code never exists in the repository—not in git history, not on the filesystem, not in the README. It only exists in DNS records. This means:
- Standard code scanners cannot find it;
- Human code review cannot see it;
- The AI agent cannot see it either—it is outside the agent's view.
- Anthropic had not publicly responded as of 09:30 Beijing time, June 30;
- 0DIN's report includes no CVSS score or evidence of in-the-wild exploitation, but the "DNS channel + auto-setup" combination is highly generalizable;
- Whether other agents (Gemini CLI, Cursor CLI, Aider, Continue.dev) are similarly affected requires independent verification. Tools with IDE sandbox isolation like Cursor may have a smaller attack surface, but terminal-only agents are almost certainly on the same risk surface;
- On defense: there is no silver bullet. The most practical interim measures are "never let an agent auto-run setup scripts" or "place external repos in a read-only container before letting the agent operate."
The attack requires an agent that triggers the setup script, actively querying DNS to "pull in" the payload. Claude Code is the first agent verified to do this; comparable tools (Gemini CLI, Cursor, Aider) are theoretically exposed to similar risk.
0DIN's remediation advice is simple: agents should display the contents of any setup script to the user before running it. But no agent currently does this—because "automatically running setup scripts" is a headline productivity feature.
Analysis
Why is this a supply chain attack rather than a prompt injection attack?
Over the past 18 months we have seen many prompt injection stories—malicious instructions planted in READMEs, issues, or commit messages. But those attacks leave a fingerprint: they are written in a file, catchable by git blame, code review, and static analysis.
This attack is different. The payload is entirely outside the git repository—it lives in DNS. DNS records are designed to be dynamically modifiable, so an attacker can switch payloads between "when the victim opens the repo" and "when a security researcher inspects it."
This is a neglected attack surface: the agent's own behavior triggers real-time queries to external network resources, and that query path has never been audited as a trust chain.
"Auto-running setup scripts" is an implicit promise from agents.
When a user opens a repo with Claude Code, it will automatically run npm install, pip install, make, cargo build—a convenience feature. The flip side is that the agent makes a trust decision on the user's behalf: deciding "this code is safe to execute." A human developer would personally look at setup.sh first; the agent silently makes the promise "I've read this code, it's safe"—a promise that has never been audited, until now.
Background on 0DIN.
0DIN is Mozilla's GenAI bug bounty platform launched in 2024, focused on prompt injection, jailbreaks, and agent privilege escalation in GenAI systems. This disclosure went through 0DIN's standard bounty process—implying responsible disclosure with an advance notification window for Anthropic. As of this writing, there has been no public response from Anthropic.
Why It Matters
1. The trust model of AI coding is being rewritten. You used to trust a repo because you trusted its code; now you trust a repo because you trust that "the agent reading it won't make decisions you don't know about." Nobody audits this new layer of trust. 2. The DNS channel becomes a new attack surface. Any design where "agents query external network resources at runtime" needs re-evaluation—package installs, CDN assets, CI scripts, documentation links. 3. AI coding governance will become a compliance issue. A developer at a financial firm opening a "normal-looking" external repo with Claude Code could leak sensitive internal credentials—three months ago this was theory; now it has a verified PoC. 4. "Auto-run setup" is turning from a productivity feature into a liability. All agent tools' automated environment setup will be redesigned—either "show first, then ask," or sandboxed execution.