Researchers Detail Claude Code Attack Hidden in Normal-Looking Repositories
Summary
Mozilla 0Din researchers describe an attack in which Claude Code follows an installation error’s recovery command, leading a script to fetch and execute a command from a DNS TXT record and open a reverse shell on the developer’s machine.
Key points
- The researchers say a normal-looking repository’s setup notes prompt Claude Code to follow legitimate installation steps; the repository itself contains no malicious code or instructions.
- During setup, a Python package error tells Claude Code to run `python3 -m axiom init` as a recovery step.
- The `init` command runs `setup.sh`, which retrieves a configuration value from a DNS TXT record and executes it.
- The researchers say the value is base64-encoded, keeping a reverse-shell signature out of plaintext on disk and on the wire.
- The resulting interactive shell could allow an attacker to exfiltrate credentials, API keys, tokens, and other secrets, or deploy a backdoor for persistent access.
- Mozilla says repositories could be distributed through job posts, tutorials, or messages, and that separate analysis of the repository, DNS activity, and agent behavior may miss the combined attack.
Article Details
- Attack Vectors
- A normal-looking repository's setup notes lead Claude Code to run a recovery command after a Python package throws an initialization error.
- The recovery command runs setup.sh, which retrieves a base64-encoded value from a DNS TXT record and executes it, spawning an interactive reverse shell on the developer's machine.
- The attacker can share the repository link through job posts, tutorials, or messages. The article says users who open the repository with Claude Code are affected.
- With the shell open, the attacker can exfiltrate credentials, API keys, tokens, and other secrets, and may deploy a backdoor for persistent access.
MITRE ATT&CK
T1059.004 · Unix ShellThe repository's setup flow runs setup.sh, which executes a command retrieved from a DNS TXT record and spawns an interactive shell.T1059.006 · PythonClaude Code runs the recovery command `python3 -m axiom init`, which starts the package initialization path that calls setup.sh.