stride

if you're using claude code and doing experiments on a day to day basis then be careful hackers are creating hundreds of fake github repos disguised as legit tools.. crypto bots, trading tools, ai utilities, telegram bots.. polished readme files. ai generated documentation. real looking star counts.. you clone it. run npm install. and it's over. a campaign called gitvenom alone created 200+ fake repos. one victim lost 5 btc.. $485,000 from a single clone. what the malware does silently: > it steals every password saved in your browser > grabs your crypto wallet keys and seed phrases > copies your ssh keys, github tokens, api credentials > installs a "clipper" that swaps wallet addresses when you copy paste… you think you're sending to your own wallet but you're sending to theirs > packages everything into an archive and sends it via telegram to the attacker you won't even know it happened until your wallet is empty.. And also, when you clone a repo and open claude code in that directory it reads the project files.. claude.md, .claude/ folder, settings.json, hooks, mcp configs. attackers are now weaponizing this. a malicious claude.md file can: > instruct claude to run hidden shell commands that look like a normal build process > exfiltrate your ssh private keys, aws credentials, api keys, env secrets > bypass claude code's deny rules entirely by chaining 50+ subcommands.. the safety system breaks after the 50th command and stops checking > leak your anthropic api key before you even see a trust prompt protect yourself.. save this checklist. before cloning any repo: > check the repo age.. was it created this week? red flag > check contributors.. is it one anonymous account? red flag > check stars vs age.. 500 stars on a 2 day old repo? fake > read the code before running anything. especially package.json scripts, postinstall hooks and any shell scripts > google the repo name + "malware" or "scam" before cloning and please never keep crypto wallets on the same machine you use for cloning random repos. use a hardware wallet. always.