Hackers Used the Claude Code Leak to Spread Malware

You might already have the malware installed — and you don’t even know it.

Not a theory. Not a “what if” scenario. This is what happened on March 31, 2026 — and thousands of developers may have already been hit before any warning went out.

793 developers starred that GitHub repo. It was packed with malware.

Below: a full breakdown of this claude code leak malware attack — plus how to check if you’ve already been hit.

The GitHub Trap Nobody Warned You About

On March 31, 2026, Anthropic accidentally shipped a 59.8 MB JavaScript source map inside the @anthropic-ai/claude-code npm package version 2.1.88. That source map exposed roughly 513,000 lines of TypeScript that weren’t obfuscated — the entire Claude Code agent harness, fully uncensored, according to Zscaler ThreatLabz.

The leak went viral within hours.

But that’s not even the most dangerous part.

The most dangerous part is what hackers set up after the code got out — and how fast they moved.

What Actually Happened — and Why It Spread So Fast

Right after the leak, security researcher Chaofan Shou (@Fried_rice) posted a public disclosure on X. Within hours, the leaked repo was forked thousands of times across GitHub, according to The Hacker News.

Of course developers were curious. The source code of one of the world’s most popular AI coding agents just leaked — who wouldn’t want to see it?

But that’s exactly where hackers stepped in.

They didn’t need to hack anyone. They just needed to exploit one thing: developers’ instinct to explore whatever’s going viral.

How Hackers Turned Curiosity Into a Claude Code Leak Malware Attack

Search “leaked Claude Code” on Google. One of the top results — before it got taken down — was a GitHub repo owned by an account called ‘dbzoomh’, according to BleepingComputer.

The repo looked legit. 793 forks. 564 stars. It looked exactly like the real source code everyone was talking about.

Inside was a .7z archive.

And inside that archive:

A Rust-based dropper called ClaudeCode_x64.exe — which installs Vidar v18.7 (an infostealer that swipes credentials and browser history) plus GhostSocks (a SOCKS5 trojan that turns your device into an anonymous proxy relay), based on deep analysis from GBHackers.

Here’s how the attack chain went:

1. Developer searches “leaked Claude Code” on Google
2. Clicks the first result — the ‘dbzoomh’ repo with hundreds of stars
3. Downloads the .7z archive thinking it’s the real source code
4. Runs ClaudeCode_x64.exe
5. Vidar steals all credentials saved in the browser
6. GhostSocks turns the device into an anonymous proxy node without the owner knowing

Every step looks like a normal thing to do when checking out leaked source code.

And this isn’t a one-off attack. According to Trend Micro, the same actor is running a rotating-lure campaign targeting more than 25 different software brands, with 38 distinct .7z archives already identified. Claude Code was just the hottest lure at the time — the next one could be a tool you use every day.

3 Quick Steps to Check If You’ve Already Been Hit

There’s a critical window you need to know about.

According to The Register, users who updated Claude Code via npm on March 31, 2026 between 00:21–03:29 UTC may have received a trojanized version — one that contained an HTTP client with a remote access trojan baked in.

If you updated during that window, do this now:

1. Check your npm install history
Run npm list -g @anthropic-ai/claude-code in your terminal and check the last install date. If there was any activity between 00:21–03:29 UTC on March 31, 2026, don’t reinstall until you’ve finished scanning. Note the installed version for reference.

2. Run a full antivirus scan
Vidar v18.7 is already detected by most modern antivirus tools. Update your definitions first, then run a full system scan. Pay extra attention to the %TEMP% and %AppData%\Roaming folders. If anything gets quarantined, screenshot and save it before deleting — useful if you need an incident report.

3. Rotate your important credentials now
If you ever downloaded or ran anything from the ‘dbzoomh’ repo, assume every password saved in your browser is compromised. Prioritize your GitHub, AWS, GCP, and other cloud accounts. Enable 2FA if you haven’t already — and for SSH keys and API tokens, rotate all of them.

What You Need to Watch — This Campaign Isn’t Over

Remember that number — 793 stars — we mentioned at the start?

Now you know why that number matters. It’s not just about popularity — it’s a snapshot of how many developers may have interacted with that malicious repo before it got taken down.

This campaign isn’t stopping. Trend Micro reports the same actor has already targeted 25+ different software brands. The next lure could be a tool you use every day.

Ask yourself:

How many times have you searched “leaked software” this month just out of curiosity?

That’s exactly what this attack exploited — developers’ instinct to explore new things. And that instinct will be targeted again.

Frequently Asked Questions

How do I know if my device was hit by the claude code leak malware?

Run npm list -g @anthropic-ai/claude-code and check the install date. If there’s any activity between 00:21–03:29 UTC on March 31, 2026, run a full antivirus scan immediately and rotate all credentials saved in your browser — especially GitHub, AWS, and cloud accounts. Vidar v18.7 is detected by modern antivirus tools that are up to date.

Is the Claude Code npm package safe now?

Yes. Anthropic has pulled the problematic version and released a patch. Make sure you’re using the latest version from the official npmjs.com source. Don’t install from third-party GitHub repos claiming to provide leaked source code — that’s almost certainly a trap from the same campaign.

Check Now, Don’t Wait

Check your npm install history now — use the steps above to make sure you weren’t hit during the March 31 window.

Bookmark this before your next dev session. The campaign is still active, and the next lure could use a tool you work with every day.