They thought they were downloading Claude Code source. They got a nasty dose of malware instead

Attackers distributed trojanized copies of the leaked Claude Code source that bundled credential‑stealing malware (reported as Vidar) and a GhostSocks backdoor/proxy. Tens of thousands of users downloaded the poisoned packages from popular developer distribution channels, putting developer machines, API keys, tokens, and downstream supply chains at risk of credential theft and remote access. Organisations and devs should assume compromise, rotate keys, scan and rebuild affected hosts from clean images, and only use verified official sources/releases.