\u201cDevelopers should treat setup instructions and scripts in unfamiliar repositories as untrusted code, regardless of what their AI tool recommends,\u201d they added. <\/p>\n
![](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/04\/devider.webp\"\/)
<\/p>\n
A malicious GitHub repository can silently compromise a developer\u2019s machine without containing a single line of malicious code, security researchers at Mozilla\u2019s Zero Day Investigative Network (0DIN) warned.<\/p>\n
The attack<\/p>\n
The proof-of-concept attack targets AI-powered coding agents such as Claude Code, and uses indirect prompt injection to manipulate an AI agent into taking harmful actions the developer never explicitly authorized.<\/p>\n
The attack chain is as follows: <\/p>\n
The malicious repository presents normal-looking setup instructions in the README file
\nA Python package is engineered to fail on first use and direct the user to run an initialization command
\nThat command calls a shell script, which resolves a DNS TXT record controlled by the attacker, and pipes its contents directly to bash.<\/p>\n
The executed malicious payload \u2013 a reverse shell in this case \u2013 is not in the repository. It\u2019s fetched and executed only at runtime. Thus, the payload is \u201cinvisible\u201d to code review, static analysis tools, and the AI agent reading the repository. <\/p>\n
The agent simply follows the setup steps, recovers from an expected error as instructed, and unknowingly opens a connection back to the attacker\u2019s server. From that point, the attacker has an interactive shell running with the developer\u2019s own privileges. <\/p>\n
\u201cAgentic coding tools have access to everything they need for this [attack]: private data, including environment variables, credentials, API keys, and local configuration files,\u201d the researchers noted.<\/p>\n
Advice for developers<\/p>\n