In early April 2026, the crypto and developer communities faced a new wave of cyberattacks. Threat actors began массово creating malicious GitHub repositories disguised as leaked source code of Claude Code — an AI tool developed by Anthropic. Under the promise of “unlocked enterprise features” and “removed limits,” users were tricked into downloading archives containing dangerous infostealers and proxy malware capable of stealing sensitive data and crypto keys.
⚠️ Critical threat: Infection is delivered via a Rust-based dropper that installs two components: the Vidar v18.7 infostealer and GhostSocks — a proxy tool that turns the victim’s device into a residential proxy node.
The incident originated from an accidental exposure by Anthropic: a JavaScript source map (~59.8 MB) was included in an npm package of Claude Code. It contained over 512,000 lines of unobfuscated TypeScript across ~1,900 files.
The leak revealed:
The code quickly spread across GitHub and file-sharing platforms — creating perfect conditions for exploitation.
Malicious repos were optimized for search queries like “leaked Claude Code,” “enterprise unlocked,” and “no limits,” allowing them to temporarily rank high on Google.
README files claimed the code was extracted from official npm source maps, giving the project false legitimacy.
Users downloaded a 7-Zip archive containing an executable (ClaudeCode_x64.exe) — a Rust-based malware loader.
“The weakest link in security is always the human. One click is enough,” — Kevin Mitnick.
Vidar v18.7 collects:
Data is sent to attacker-controlled servers for resale or further attacks.
🔍 Infostealers caused over $1.2B in crypto losses in 2025 alone.
Attackers exploit trust in legitimate platforms rather than breaking systems directly.
“Security is a process, not a product,” — Bruce Schneier.
The Claude Code leak shows how quickly attackers adapt. Hype becomes a weapon, and trust in platforms becomes the vulnerability.
For crypto users, the risk is especially severe — stolen keys mean irreversible losses.
🔐 Golden rule: In open source — trust, but verify.
Security today is not about tools — it’s about awareness. And in this environment, the most protected user is the most skeptical one.
