Updated 2026-11-15
Short answer: a malicious repository rarely hides its payload in the code you would review. It puts it in what runs on its own: package install scripts, Visual Studio build events, editor tasks that run when a folder opens, AI agent hooks, CI workflows and prebuilt binaries. Read those files first, with the commands below, before you install, build or open the project in an editor. A virus scan of the repository will not see a payload that is downloaded later.
PreBuildEvent in .csproj files, which runs before the project compiles, in .suo files holding a PowerShell command, and in Python and Go files behind long runs of spaces. It ended in AsyncRAT, a clipboard clipper and a data stealer reporting to a Telegram bot, and had infected more than 2,000 PCs. The first such repositories, two years ago, were blockchain game bots and cheats.| File | When it runs |
|---|---|
package.json preinstall, install, postinstall, prepare | On npm install and npm ci (npm docs) |
*.csproj, *.vcxproj build events, .suo | When Visual Studio builds the project; the .suo held a PowerShell command (Doctor Web) |
.vscode/tasks.json with "runOn": "folderOpen" | When the folder opens in VS Code, if the workspace is trusted and automatic tasks are allowed (VS Code docs) |
.claude/settings.json hooks, .mcp.json | Claude Code hooks such as SessionStart run when a session begins; .mcp.json adds MCP servers after you approve them (Claude Code docs) |
.github/workflows/*.yml | In GitHub Actions, on the events the workflow lists |
Release assets, .exe, .dll, archives in the tree | When you run them; you cannot read them like source |
Clone the repository, do not install or build it, and run these from its root:
grep -nE '"(preinstall|install|postinstall|prepare)"' package.json
grep -rniE 'PreBuildEvent|PostBuildEvent|powershell' --include=*.csproj --include=*.vcxproj --include=*.props --include=*.targets .
find . -name '*.suo' -not -path './.git/*'
grep -rn 'folderOpen' .vscode 2>/dev/null
cat .claude/settings.json .mcp.json 2>/dev/null
ls .github/workflows 2>/dev/null && grep -nE 'curl|wget|base64|powershell' .github/workflows/*
grep -rnlE ' {200,}' --include=*.py --include=*.go --include=*.js --include=*.ts .
find . -type f \( -name '*.exe' -o -name '*.dll' -o -name '*.7z' -o -name '*.zip' \) -not -path './.git/*'
gh release view --repo OWNER/REPOThe ' {200,}' search lists files with a line of 200 or more spaces in a row, the hiding trick Doctor Web describes. Doctor Web also lists attacker addresses found in the fake repositories, among them muckanthropic[.]com, muckcoding[.]com, muckdeveloper[.]com and 130.12.182[.]172:
grep -rniE 'muckanthropic|muckduck|muckcoding|muckdeveloper|130\.12\.182\.172' .
A hit in any of these is a reason to stop and read the code around it, not proof by itself. An empty result is not a clean bill either: these checks cover the known places, and a project can still download its payload later. Replace OWNER/REPO with the repository's path. On Windows machines Doctor Web found the PowerShell stage at C:\Users\Public\Pictures\t.ps1 or L.ps1 and the unpacked loader under C:\ProgramData\Windows.Microsoft.Photos:
Get-ChildItem C:\Users\Public\Pictures\*.ps1, C:\ProgramData\Windows.Microsoft.Photos -ErrorAction SilentlyContinue
When you choose "Yes, and don't ask again" in Claude Code, it saves that approval as an allow rule in .claude/settings.local.json (Claude Code docs). The Hacker News, reporting Apiiro's research, says the rule keeps the command word for word, so a password typed into the command ends up in the file. Claude Code adds that file to your global git excludes the first time it writes it, but not to the project's .gitignore. Apiiro found 1,122 public copies of the file on GitHub with at least one secret, as reported by The Hacker News. To see whether a repository ever tracked it:
git log --all --oneline -- .claude/settings.local.json
FixLane pages: fake GitHub security projects install backdoors and infostealers, AsyncRAT, clipper and infostealer in fake security tools, Claude Code 'don't ask again' saves secrets into project files, CI secret stealer pushed through compromised GitHub accounts.
Antivirus can scan the files, but the payloads in recent campaigns were downloaded only after a build or install step ran. Reading the install scripts, build events, editor tasks, AI agent hooks and workflows before running anything covers what a scan of the repository cannot see.
Yes, a task in .vscode/tasks.json with runOn folderOpen runs when the folder opens, but only in a trusted workspace and only if automatic tasks are allowed. By default VS Code asks once per workspace.
Doctor Web found the malware in Visual Studio PreBuildEvent entries and .suo files, and in Python and Go files behind long runs of spaces. The infected files start a PowerShell script that fetches the loader. More than 2,000 PCs were infected.
Cloning on its own does not run the project's scripts, which start when you install, build, open it in an editor or run it. Keep Git itself current: a malicious repository could run code through a recursive clone before Git CVE-2026-111760 was fixed.
Connect an AI agent to the free, read-only FixLane MCP server or ask the Telegram bot: it checks what you have installed against verified fixed versions and serves a reviewed fix procedure. All guides.