They thought they were downloading Claude Code source. They got a nasty dose of malware instead

Zscaler researchers discovered a malicious GitHub repository masquerading as leaked Claude Code source that distributed a Rust dropper which installs Vidar infostealer and GhostSocks proxy; the repo appeared high in search results, had many forks/stars, and included a malicious .7z release. The report notes active exploitation, provides IOCs (repo links and hashes), and warns defenders to avoid downloading trojanized repositories.