Trending Now - Malware Masquerades as Claude Code Source on Github
WHO:
BleepingComputer - Threat actors are exploiting the Claude Code source code leak.
BleepingComputer - Anthropic is the organization behind Claude Code.
The Register - Zscaler's ThreatLabz researchers discovered the malicious GitHub repository.
WHAT:
BleepingComputer - Anthropic accidentally exposed the full client-side source code of Claude Code via a 59.8 MB JavaScript source map included in the published npm package on March 31st, 2026.
BleepingComputer - The exposed code revealed the agent’s orchestration logic, permissions, execution systems, hidden features, build details, and security-related internals.
BleepingComputer - A second GitHub repository with identical code was discovered, which had a non-functional ‘Download ZIP’ button at the time of analysis.
BleepingComputer - Anthropic issued over 8,000 copyright takedown requests after the leak of the Claude Code source code.
BleepingComputer - The malicious GitHub repository published by user “idbzoomh” was found to have been optimized for search engines to appear at the top of Google search results for queries related to "leaked Claude Code."
The Register - The malicious .7z archive in the repository's releases section is named "Claude Code - Leaked Source Code" and includes a Rust-based dropper named ClaudeCode_x64.exe, which drops Vidar v18.7 and GhostSocks onto users' machines.
BleepingComputer - Fake GitHub repositories are being used to deliver Vidar information-stealing malware.
BleepingComputer - The leak contained 513,000 lines of unobfuscated TypeScript across 1,906 files.
The Register - Tens of thousands of people downloaded the leaked Claude Code source code.
The Register - The malicious GitHub repository had 793 forks and 564 stars at the time of analysis.
The Register - The malware includes Vidar, which steals account credentials, credit card data, and browser history, and GhostSocks, which proxies network traffic.
WHERE:
BleepingComputer - The malicious GitHub repository is accessible on GitHub.
The Register - The repository was optimized for search engines to appear in Google search results.
WHEN:
BleepingComputer - The source code leak occurred on March 31st, 2026.
The Register - A similar malware campaign was warned about in March 2026.
WHY:
BleepingComputer - The leak created an opportunity for threat actors to deliver malware to users seeking the Claude Code leak.
The Register - Criminals quickly exploit new products or news events for online scams and financial gain.
HOW:
BleepingComputer - The malicious GitHub repository is designed to drive traffic by appearing at the top of Google search results for queries related to "leaked Claude Code."
BleepingComputer - The researchers noted that the malicious archive is updated frequently, indicating that other payloads may be added in future iterations.
BleepingComputer - Users are tricked into downloading a 7-Zip archive containing a Rust-based executable named ClaudeCode_x64.exe.
The Register - The README file in the malicious repository claims the code was exposed through a .map file and offers "unlocked" enterprise features.
The Register - The malware is deployed when the executable is launched, dropping Vidar and GhostSocks onto users' machines.
(UPDATED April 3, 2026 19:23 UTC)
Anthropic accidentally exposed the full client-side source code of Claude Code when a 59.8 MB JavaScript source map was included in a published npm package on Tuesday. The leaked code revealed critical details, including the agent's orchestration logic, permissions, execution systems, and security-related internals, while a second GitHub repository with the same code was found to have a non-functional 'Download ZIP' button. This malicious GitHub repository was designed to attract traffic by ranking high in Google search results for queries related to "leaked Claude Code."
--
(UPDATED April 3, 2026 09:15 UTC)
Anthropic has taken significant action by issuing over 8,000 copyright takedown requests following the leak of the Claude Code source code. A malicious GitHub repository, created by a user named "idbzoomh," was designed to rank highly in Google search results for terms related to the leaked code and contains a harmful archive titled "Claude Code - Leaked Source Code," which includes a Rust-based dropper that installs malware on users' devices. Researchers have observed that this malicious archive is frequently updated, suggesting that additional harmful payloads could be introduced in future versions.
--
(UPDATED April 3, 2026 07:19 UTC)
Threat actors are exploiting a recent leak of the Claude Code source code, which was released on Tuesday, and contained over 513,000 lines of TypeScript across nearly 2,000 files. Researchers from Zscaler's ThreatLabz found that fake GitHub repositories are being used to deliver Vidar information-stealing malware, tricking users into downloading a malicious 7-Zip archive that contains an executable disguised as the Claude Code. This malware not only steals sensitive information like account credentials and credit card data but also includes GhostSocks, which proxies network traffic, making it a significant threat to those who sought the leaked code.