Claude Code Hook Malware: 42 Repos That Execute Before You Type
Forty-two real GitHub repositories were armed with project config files that run a hidden payload the moment Claude Code, Gemini or Cursor opens the folder. No prompt injection, no prompt shown. And the wiper fires if you revoke the stolen token first.
Devdatta Narawade13 min