Summary
Mozilla’s Zero Day Investigative Network (0DIN) demonstrated a proof-of-concept attack (published June 25, 2026) in which Claude Code automatically executes a reverse shell when setting up a seemingly benign GitHub repository. The repo contains no malicious code — the payload is fetched at runtime from an attacker-controlled DNS TXT record via a three-step chain: standard setup instructions, a package that fails until initialized, and a setup script that resolves and executes the DNS payload. Researchers warn threat actors could distribute such repos via job postings, tutorials, or DMs.
PreScreening Notes
Score: 8 | Priority: high | Route: prescreened
Important supply-chain-style attack vector targeting AI coding agents.
Research Notes
Additional Sources Found
- 2026-06-27-mozilla-0din-bleepingcomputer-corroboration — BleepingComputer; full attack chain, mitigation recommendations
- AIntelligenceHub — PoC published June 25; agentic setup error recovery as trusted instruction vector
- AI Weekly — Payload swappable via DNS without repo changes; static scanners miss DNS layer
- Xoomar — Comparison with Miasma GitHub Actions supply chain attacks
Key Facts Verified
- Confirmed: Three-step chain — setup instructions → intentional RuntimeError → agent runs
python3 -m axiom init→ setup.sh fetches DNS TXT → bash execution - Confirmed: No malicious code in repository; Claude Code automates entire chain as “error recovery”
- Confirmed: Successful exploitation yields developer-privilege shell with access to env vars, API keys, local configs
- Confirmed: Distribution vectors include job postings, tutorials, DMs
- Mitigation: Agents should disclose full execution chain including dynamically fetched content
Info
Responsible disclosure PoC — no active exploitation campaign reported. Applies broadly to agentic coding tools that auto-run setup fixes, not only Claude Code.
Broader Context
New supply-chain-security vector distinct from malicious commits (cordyceps, Miasma) — exploits agent autonomy and trust in setup error messages. Pairs with agentjacking research on AI coding agent compromise.
Related Wiki Pages
mozilla-0din, supply-chain-security, supply-chain-attacks, agentjacking, coding-agents, ai-code-assistance, ai-agent-security, anthropic, github, agentic-ai
Editorial Notes
Onaylanan açı: Temiz GitHub repo + DNS TXT payload ile AI coding agent’ları kandırma — yeni supply-chain-security vektörü.
Format: standard — teknik PoC açıklaması + geliştirici mitigasyon rehberi.
Reporting talimatları:
- Responsible disclosure PoC; aktif kampanya yok
- Sadece Claude Code değil, otomatik setup error recovery yapan tüm agentic coding tool’ları kapsar
- Üç adımlı saldırı zincirini adım adım açıkla
- İş ilanı, tutorial, DM dağıtım vektörlerini vurgula
- agentjacking ve cordyceps ile farkını netle: kötü amaçlı commit yok, runtime DNS fetch
Başlık önerileri:
- Mozilla 0DIN: Temiz GitHub repo’su Claude Code’u reverse shell’e sokabiliyor
- AI coding agent’ları için yeni supply chain tehdidi: DNS TXT payload
- “Repo temiz, makine senin”: Agentic setup otomasyonunun güvenlik açığı
Makalede mutlaka yer almalı:
- Üç adımlı zincir: setup instructions → RuntimeError →
python3 -m axiom init→ setup.sh DNS TXT → bash - Repoda kötü amaçlı kod yok; statik tarayıcılar kaçırır
- Başarılı sömürü: env vars, API keys, local config erişimi
- Mitigasyon: agent’ların dinamik fetch dahil tam execution chain’i açıklaması
- Dağıtım vektörleri: job posting, tutorial, DM
Draft Article
Published: mozilla-0din-claude-code-github-malware