Claude Code 打开 GitHub 仓库即执行隐藏恶意代码，攻击者可获完全控制

Claude Code runs a GitHub repo's hidden malware without verification, giving attackers full control

AI 导读

安全研究人员在 Mozilla 的 GenAI 漏洞赏金平台 0DIN 发现新攻击向量。一个看似正常的 GitHub 仓库包含 setup 脚本，该脚本运行时从 DNS 条目拉取命令并执行，恶意代码从未存在于仓库中，对扫描器、代码审查和 AI 智能体不可见。开发者使用 Claude Code 等 AI 编码工具打开该仓库时，Claude Code 在设置过程中遇到常规错误消息后自动运行该脚本，打开反向 shell，攻击者可窃取 API 密钥和登录凭据并维持持久访问。研究人员建议 AI 智能体应在运行前显示 setup 脚本内容，开发者应将第三方仓库的 setup 说明视为不受信任代码。

推荐理由

用 AI 编码工具克隆仓库就能被反向 shell 控制，这个攻击向量比想象中简单。0DIN 的研究把整个链拆得很清楚，每条修复建议开发者现在就能用。

正文 · 原文

Security researchers at 0DIN, Mozilla's GenAI bug bounty platform, found a new attack vector targeting developers' machines. Through a normal-looking GitHub repository, attackers can gain full control via indirect prompt injection as soon as someone uses an AI coding tool like Claude Code on it.

A setup script in the repo pulls a command from a DNS entry at runtime and executes it. The malicious code never exists in the repository itself, making it invisible to scanners, code reviews, and the AI agent. Claude Code hits a routine error message during setup, automatically runs the script, and opens a reverse shell to the attacker. From there, the attacker can grab API keys and login credentials and maintain persistent access. One repo link in a job posting, tutorial, or Slack message is enough to compromise anyone who opens it with an AI coding tool.

The fix, according to the researchers: AI agents should show what's in a setup script before running it. And developers should treat setup instructions in third-party repos as untrusted code.