Security researchers at Mozilla's 0DIN platform have shown how a single compromised GitHub repo can take over a developer's machine the moment an AI coding tool like Claude Code runs its setup. The catch: the malicious code only loads at runtime via a DNS query, invisible in the repo, to scanners, and to the AI agent itself.
The article Claude Code runs a GitHub repo's hidden malware without verification, giving attackers full control appeared first on The Decoder.
source & further reading
the-decoder.com — original article
Samsung and SK Hynix plan $590 billion chip investment as AI demand sends memory prices soaring
AI won't become a real coworker until it stops answering and starts finishing tasks
Coinbase joins the rush to Chinese AI models as Western labs face a pricing stress test