Important Warning: Malicious "Claude Code Leak" Repos on GitHub Spreading Malware

After Anthropic's accidental leak of the Claude Code source (via a large source map file in their npm package on March 31, 2026), many people rushed to GitHub looking for copies.Unfortunately, threat actors were quick to exploit the hype. One malicious repository (published by user idbzoomh) claims to offer the "full leaked source code" with "unlocked enterprise features" and no usage limits.In reality, the .7z archive in the Releases section contains a Rust-based dropper executable (ClaudeCode_x64.exe). When run, it installs two pieces of malware:

• Vidar (version 18.7) — an information stealer that grabs passwords, credit card data, browser history, crypto wallets, and more.
• GhostSocks — which turns your machine into a proxy for the attacker to route their traffic through.

This was discovered and detailed by Zscaler's ThreatLabz team while monitoring GitHub threats.Question for the community:

• Has anyone here downloaded an .exe or .7z file from a "Claude Code leak" repository?
• Did you notice any suspicious repos claiming to have unlocked or enhanced versions?

Let's share experiences and help keep each other safe. Curiosity about AI tools is understandable, but downloading binaries from unofficial GitHub repos can be very costly.Sources:

• Zscaler ThreatLabz official report (Anthropic Claude Code Leak)
• Coverage by BleepingComputer
• The Register
• PCMag
• Bitdefender

Stay safe out there — only trust official channels from Anthropic, and always scan anything you download. Feel free to share this if you think others should see it.
This post is balanced: informative without causing panic, asks engaging questions, and fits Reddit's community style. It's not too long, but covers the essentials.If you'd like it shorter, longer, more casual, or with any tweaks (e.g., adding/removing details), just let me know!