Mozilla researchers revealed a new attack that tricks Claude Code into running hidden commands from seemingly harmless GitHub repositories.

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...