Why This Matters
The news said "LEAK." We're here to explain what that actually means.
Over a dozen major security outlets covered the Claude Code malware campaign. Their reports are thorough — binary analysis, C2 infrastructure, threat actor attribution. But most people read the headline and think: "Should I be worried? What actually happened? What does this look like?"
That's what this report is for. We took the real attack materials, ran them through Sunglasses (our open-source content-layer security filter), and broke down exactly what was hiding in those fake repositories — in both technical detail and plain English. We show what the attacks look like, explain why they're dangerous, and demonstrate how content-layer filtering catches them before a human clicks download or an AI agent ingests the content.
The Attack Timeline: From Leak to Malware
A 59.8MB JavaScript source map is included in the Claude Code npm package (v2.1.88) due to a packaging error. Within hours, researcher Chaofan Shou discovers and posts the link. 512,000 lines of TypeScript are exposed publicly.
Threat actors create fake GitHub repositories under organization accounts, using the leak as a lure. READMEs promise "leaked source code" and "unlocked enterprise features." GitHub Releases host trojanized .7z archives.
The repository leaked-claude-code/leaked-claude-code is live on GitHub. It distributes ClaudeCode_x64.exe — a Rust-based dropper that installs Vidar v18.7 (infostealer) and GhostSocks (proxy malware). Downloads recorded via GitHub Releases.
Security firm Adversa AI publicly discloses a Claude Code permission bypass vulnerability — the "50-subcommand" deny-rules bypass. This adds a second attack vector to the ecosystem fallout.
The Register, BleepingComputer, Trend Micro, SecurityWeek, TechRadar, Bitdefender, and others publish coverage of the malware campaign.
We scan the actual attack materials. Sunglasses catches 7 threat signals across 4 files. All blocked. Every finding mapped to specific detection rules. Total scan time: ~10ms.
What We Scanned
We collected text-based content from two sources tied to the Claude Code security fallout:
The fake leaked-claude-code/leaked-claude-code GitHub repository that uses the real leak as bait to distribute malware. We extracted the README content and supporting text — the social engineering layer that convinces people to download the malicious .exe.
The attack code from Adversa AI's disclosure showing how Claude Code's permission system can be bypassed with 50+ subcommands. This is the prompt-layer attack that targets trust assumptions inside the AI assistant itself.
What we did NOT do: We did not download or execute the ClaudeCode_x64.exe binary. Sunglasses scans text content (READMEs, code, prompts, docs) for attack patterns. Binary malware analysis is handled by antivirus tools. Our role is catching the social engineering and code-level threats that trick humans and AI agents before the binary is ever downloaded.
Scan Results: 7 Threats Across 4 Files
| File | Decision | Threats | Severity | Time |
|---|---|---|---|---|
| Trojanized Repo README | BLOCK | 1 | HIGH | 3.50ms |
| Adversa Deny-Rules Bypass | BLOCK | 2 | CRITICAL | 3.01ms |
| Suspicious Repos Index | BLOCK | 1 | HIGH | 1.68ms |
| Attack Patterns Collection | BLOCK | 3 | CRITICAL | 2.59ms |
Detailed Findings
The fake repository's README uses classic jailbreak terminology to attract users looking for Claude Code bypasses. It claims "no censorship," "no limits," and "enterprise-level features unlocked" — social engineering designed to override caution. Sunglasses flagged this across 3 of 4 scanned files.
What does this mean in plain English?
"It's like a storefront with a giant FREE sign — the words themselves are the warning." This is a type of social engineering attack — scammers use specific language to get you excited and turn off your critical thinking. Words like "no limits," "unlocked," "free enterprise features" are bait. No legitimate software project talks like this. This technique is commonly used in GitHub malware campaigns where attackers create fake repositories that look real.
Sunglasses detects this using prompt injection pattern matching — a database of known scam phrases that gets checked automatically, the same way your email spam filter catches "You've won $1,000,000!" without you reading every email.
Real-world example: Imagine someone offers you a "free unlocked iPhone with no restrictions." You'd know that's a scam. This is the same thing, but for software — and developers fall for it because the technical language around it looks convincing. This specific attack targeted people searching for the Claude Code source code leak on GitHub.
The Adversa AI bypass contains shell commands designed to be executed by the AI agent — including curl piped to execution. This type of content, if ingested by an AI coding agent without scanning, could lead to command execution with the user's permissions. AI agents that process repository content as context are especially vulnerable to embedded shell commands.
What does this mean in plain English?
"It's like someone slipping a note into your to-do list that says: go to this address and do whatever they tell you." The command curl downloads something from the internet. When it's piped to execution, your computer runs whatever it downloaded — no questions asked. This is called command injection — one of the most dangerous types of AI agent security threats in 2026. You wouldn't open a random attachment from a stranger's email. This is the same thing, hidden inside code that looks normal.
Why it's dangerous with AI coding agents: Tools like Claude Code, Cursor, and other AI coding assistants read repository content as context. If a repo contains this command, the AI might suggest running it as part of a normal workflow. The AI doesn't know it's malicious — it just sees code. This is why pre-ingestion scanning at the content layer matters — catching dangerous commands before an AI agent ever sees them.
The attack material contains instructions to read SSH private keys, Base64-encode them, and send them to an external server. This targets the most sensitive credential on a developer's machine. An AI coding agent that ingests this content as context could interpret these instructions as legitimate code, making pre-ingestion scanning critical.
What does this mean in plain English?
"It's like someone copying your house key, disguising it as a photo, and mailing it to themselves." Your SSH key is a digital master key. Developers use it to access their servers, their GitHub account, their cloud infrastructure — everything. This attack reads that key from your computer, converts it to text (Base64 encoding — think of it as putting the key in an envelope), and sends it to a hacker's server. This technique is called credential exfiltration — stealing your login credentials without you knowing.
What happens next: With your SSH key, an attacker can log into your servers as if they were you. They can steal your code, delete your projects, or use your infrastructure to attack others. This is how major supply chain attacks like the axios RAT incident work — one stolen credential can compromise entire organizations.
How Sunglasses catches it: The scanner recognizes the pattern of "read a sensitive file + encode it + send it somewhere" — that combination is almost never legitimate. This is one of 75 attack patterns in the Sunglasses database. It flags the threat before any AI agent or human acts on it.
Why This Attack Is Different: One Text Surface, Two Victim Types
The Claude Code campaign is not just a malware story. It is a trust-boundary story.
The same repository text can target two different victims at once: a human developer, by using urgency, exclusivity, and "unlocked" language to trigger a download; and an AI coding agent, by embedding dangerous commands, credential-theft instructions, and permission-bypass content into material the agent may read as context.
- The human developer — persuaded by urgency, exclusivity, and "unlocked" language to download a malicious binary
- The AI coding agent — ingesting the repository's embedded commands, credential-theft instructions, and permission-bypass content as trusted context
That makes this campaign more than a classic fake-download lure. It is a hybrid attack surface where social engineering and prompt-layer abuse can coexist in the same artifact.
This is the control point Sunglasses is built for: scanning the content before a person trusts it, before an agent ingests it, and before either one turns text into action.
Detection coverage: Sunglasses triggered 3 distinct rule families across 2 attack planes — social-engineering lure content (jailbreak roleplay) and agent-execution content (command injection + credential exfiltration) — across all 4 files. These were not seven random keyword hits. They were structured detections covering both sides of the hybrid attack.
The most important mismatch in this incident is not just malicious code versus clean code. It is trusted-distribution mismatch: attackers borrowed GitHub's trust surface and the real Claude Code leak narrative to make malicious text look like legitimate developer documentation.
Users thought they were evaluating a code repository. In practice, they were evaluating a delivery channel designed to look like a code repository.
That distinction matters because the attacker's first win is not the malware execution. The earlier win is getting the victim to trust the text.
Why This Campaign Pattern Will Repeat
This campaign model is reusable across every high-attention AI tool:
- Leak or rumor
- Fake repo or mirrored package
- "Unlocked" or "uncensored" framing
- Download lure for humans
- Embedded instructions for agents
- Credential theft or command execution after trust is won
What the Trojanized Repository Actually Does
While Sunglasses blocks the text-layer threats, here's what happens if someone downloads and runs the actual binary without content-layer filtering:
- README mixes real leak information with fake "unlocked Claude Code" claims
- A large clickable banner image links directly to the malicious .7z download
- Installation instructions tell victims to run
ClaudeCode_x64.exedirectly - Claims the API key is "securely stored using Windows Credential Manager" (likely credential theft)
- A fake disclaimer labels it as "experimental security research" to add legitimacy
- Vidar — Commodity infostealer that harvests saved passwords, browser cookies, cryptocurrency wallet credentials, credit card data, and autofill entries
- GhostSocks — Turns infected machines into proxy infrastructure that criminals use to mask their location and route malicious traffic through victim computers
- Dropper — Rust-based
ClaudeCode_x64.exe(inside 104MB .7z archive)
According to Trend Micro, this is part of a rotating-lure operation active since February 2026, impersonating more than 25 software brands while delivering the same Rust-compiled infostealer payload. The Claude Code leak gave them a fresh, high-attention lure.
The real story is not "one vendor had a bad week." The real story is:
- Leaked AI tool ecosystems create instant phishing and malware opportunities. When a popular tool's source leaks, the attention spike is a goldmine for social engineering.
- Prompt-layer bypasses and supply-chain lures stack together. The Adversa bypass targets the AI assistant's trust model. The fake repos target the human's trust. Together, they create a layered attack chain.
- Agent operators need a trust filter between raw artifacts and execution. AI coding agents ingest READMEs, docs, issues, and code. Without pre-ingestion scanning, attack content flows directly into model context.
When a widely-used tool like Claude Code has a security event, the downstream blast radius includes:
- Fake repos appearing in Google results within hours
- Social engineering calibrated to developer urgency
- Malware distributed through trusted platforms (GitHub Releases)
- AI-targeted bypasses designed to exploit the tool's permission model
This is exactly what multi-agent teams will face at scale. For teams running multiple AI agents, this kind of artifact should never move directly from an untrusted repo, feed, or inbox into a higher-trust assistant. The safe pattern is manifest-first review: scan the content, record the findings, quarantine suspicious material, and only then decide whether the raw artifact should cross the next boundary. A defensive layer that can do this in milliseconds can sit inline before every agent inbox, every CLI suggestion, every repo ingestion.
That is the same design logic behind the Sunglasses bridge filter: inspect first, summarize second, escalate only when the material is safe enough to move upstream.
The binary is only the last mile of the attack. The first compromise happens in the text — the README, the install instructions, the bypass guide. That's the content layer, and that's where filtering matters most.
Defensive Takeaways
- Do not trust "leaked-code" repositories or forks — treat them as hostile until verified
- Inspect README and install instructions for social engineering, not just the code
- Claude Code is officially distributed via Anthropic's native installer, npm, Homebrew, and WinGet. There is no legitimate standalone .exe download from GitHub Releases
- If you see "jailbreak mode," "no limits," or "enterprise unlocked" in a repo — it's a trap
- Put a content filter in front of repo ingestion and shared-file bridges
- Treat READMEs, issue threads, install guides, and leaked-code summaries as executable influence, not harmless text
- Separate low-trust ingestion from high-trust planning — untrusted artifacts should be scanned and summarized before reaching a more privileged agent
- Quarantine HTML, scripts, archives, and unknown formats by default
- Assume malware delivery and prompt bypass content can be bundled together in the same artifact
- Monitor for fake repositories after any major tool leak or security event
- After any major AI-tool leak, watch for lure language patterns: "unlocked," "no limits," "enterprise features," and permission-bypass walkthroughs
- The attack surface now includes natural-language content, not just executables
- Content-layer filtering complements antivirus — antivirus handles binaries, content filters handle the social engineering and prompt injection layer
- Speed matters: inline filtering at agent boundaries requires millisecond-level performance
Honest Assessment: What We Catch and What We Don't
- Jailbreak and social engineering language in READMEs and docs
- Dangerous shell commands (curl-to-exec, code execution patterns)
- Credential exfiltration attempts (SSH key theft, Base64 encoding tricks)
- Prompt injection patterns designed to bypass AI assistant safety rules
- 75 attack patterns, 1,273 keywords, 32 threat categories
- Binary malware analysis (the .exe itself — that's antivirus territory)
- Network behavior analysis (C2 communication, DNS callbacks)
- Obfuscated payloads using heavy encoding or encryption
- Zero-day exploits with no known pattern signature
Press Coverage: Who Reported This Attack
The following outlets have covered the Claude Code malware campaign. These outlets reported on the attack itself — none have reviewed or endorsed Sunglasses or this scan report.
- The Register — "They thought they were downloading Claude Code source. They got a nasty dose of malware instead" Apr 2, 2026
- BleepingComputer — "Claude Code leak used to push infostealer malware on GitHub" Apr 2, 2026
- Trend Micro — "Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads" Apr 3, 2026
- SecurityWeek — "Critical Vulnerability in Claude Code Emerges Days After Source Leak" Apr 3, 2026
- The Hacker News — "Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms" Apr 1, 2026
- Bitdefender — "Fake Claude code leak on GitHub pushes Vidar malware" Apr 3, 2026
- Help Net Security — "Claude code source leak exploited to spread malware" Apr 3, 2026
- TechRadar — "Be careful what you click — hackers use Claude Code leak to push malware" Apr 3, 2026
- CyberPress — "Claude Code Leak Exploited by Hackers to Deliver Vidar and GhostSocks" Apr 4, 2026
- DataBreaches.Net — "Claude Code leak used to push infostealer malware on GitHub" Apr 4, 2026
- SC Media — "Claude Code leak leveraged to distribute malware" Apr 3, 2026
- Windows Report — "Anthropic Claude Code Leak Triggers Malware Campaign on GitHub" Apr 3, 2026
| Scanner | SUNGLASSES 0.2.31 |
| Detection Rules | 75 attack patterns, 1,273 keywords, 32 threat categories |
| Rules Triggered | GLS-PI-003 (Jailbreak roleplay), GLS-CI-001 (Dangerous shell commands), GLS-EX-001 (Credential exfiltration request) |
| Scan Mode | FAST (pattern matching, message channel) |
| Total Scan Time | ~10.78ms (sum of 4 individual scans) |
| Files Scanned | 4 text-based samples extracted from attack materials |
| Sample Sources | GitHub repository content (README, code), Adversa AI disclosure (public), aggregated threat intelligence. Samples were collected from known, publicly reported attack materials — not a blind test. |
| Data Sent Externally | None. Everything runs locally. No cloud. No telemetry. |
| Source Code | github.com/sunglasses-dev/sunglasses (open source, MIT license) |
See How It Works: Interactive Example
Pick an attack example below and see how Sunglasses filters it. Dangerous content goes in. Clean verdict comes out. Your agent never sees the bad stuff.
Install once. Protected forever. Update daily for new threats.
Step 1: Install — One command: pip install sunglasses. Done. Your agent now has a protection layer.
Step 2: Integrate — Add two lines of code to your agent's pipeline. Every piece of content passes through Sunglasses before your agent sees it. Bad content gets blocked. Clean content passes through. Your agent never touches the dangerous stuff.
from sunglasses import scan
result = scan(incoming_text)
if result.decision == "allow":
agent.process(incoming_text) # clean, safe
else:
quarantine(incoming_text) # blocked, agent never sees itStep 3: Stay protected — Run pip install --upgrade sunglasses regularly. We regularly add new attack patterns and keywords to the database as new threats emerge. New threats appear daily — your protection layer should grow with them.