Hackers Spread Vidar and GhostSocks Malware Through Claude Code Leak

What happened

Hackers are weaponizing the leaked Claude Code source to spread Vidar and GhostSocks malware through malicious repositories that impersonate the exposed codebase. The campaign followed Anthropic’s March 31 packaging error, which exposed the source code for Claude Code in a public npm package through a JavaScript source map file containing more than half a million lines of unobfuscated TypeScript. After the leak was mirrored widely online, threat actors began creating fake repositories aimed at developers searching for the code. In one observed case as detailed by Zscaler ThreatLabz, a repository promised an unlocked enterprise version with no usage limits, but the downloadable archive instead contained a Rust-based dropper. When run, it deployed Vidar to steal credentials and GhostSocks to proxy network traffic. 

Who is affected

The direct exposure affects developers and organizations whose users search for, download, build, or run repositories claiming to contain the leaked Claude Code source. The campaign is aimed at developer workstations, where the malware can steal credentials and create follow-on network access through proxy tooling. 

Why CISOs should care

This incident matters because it turns a source code exposure event into a developer-targeted malware campaign. It also shows how quickly leaked proprietary code can become a lure for credential theft and workstation compromise, especially when attackers use search visibility and fake repositories to target users looking for unofficial software builds. 

3 practical actions

Block unofficial leaked-code workflows: Instruct developers not to download, build, or run any repository claiming to contain leaked Anthropic software outside official channels. 

Hunt for credential theft and proxy behavior: Investigate developer endpoints for signs of Vidar activity and unauthorized proxy behavior linked to GhostSocks. 

Tighten development environment containment: Use stronger segmentation and monitoring for developer workstations so a compromised endpoint has less access to critical internal systems and code assets. 

For more news about credential-stealing malware and malicious developer lures, click Malware to read more.