Detailed Analysis
Claude Opus, deployed through Anthropic's Claude Code product, detected and reverse engineered a sophisticated supply chain malware attack targeting a software developer's GitHub repositories before any malicious code could execute. During routine branch consolidation operations, the model identified an obfuscated payload appended to a `next.config.js` file, flagged it as an EtherHiding loader, and refused to proceed with the merge or build — all without triggering the code. The malware had been introduced through a compromised contractor's development machine, which silently exfiltrated cached git credentials and used them to force-push rewritten history into repositories the contractor had legitimate write access to. Notably, the attacker spoofed the repository owner's name, email, and commit message, and backdated the commit to blend into existing history, making human detection highly improbable through casual review.
The technical sophistication of the payload underscores why automated AI-assisted code review caught what human developers likely would have missed. EtherHiding is a technique that stores malicious payloads on public blockchains — in this case TRON, Aptos, and BNB Smart Chain — making the command infrastructure nearly impossible to take down through conventional means. The dropper itself carries no static payload, fetching encrypted code from blockchain transaction calldata at runtime and decoding it entirely in memory using XOR keys, which bypasses most file-based antivirus and static analysis tools. The final payload functions as a comprehensive infostealer targeting environment variables, npm and GitHub tokens, SSH keys, browser session cookies, and cryptocurrency wallets. The attacker's infrastructure, attributed by Mandiant to the threat actor UNC5142 and related to a stealer Malwarebytes tracks as Omnistealer, routes through a command-and-control server at 198.105.127.210 hosted on Evoxt Enterprise's network.
The incident carries significant implications for software supply chain security, a threat category that has grown substantially in recent years following high-profile attacks like SolarWinds and the XZ Utils backdoor. The attack vector here — compromising a trusted developer's machine and weaponizing their existing repository access — represents one of the most difficult categories of threat to defend against, because the malicious commits arrive through authenticated, previously trustworthy channels. Traditional CI/CD security tooling focuses heavily on known malicious signatures and network-level controls, neither of which would have caught a novel, in-memory, blockchain-fetched payload disguised as legitimate configuration file content. Claude's ability to recognize the structural anomaly of code appearing after `module.exports` in a Next.js config file, and to identify the obfuscation pattern as consistent with EtherHiding, demonstrates that large language models trained on vast codebases can develop meaningful semantic understanding of what constitutes abnormal code placement and behavior.
This case also illustrates a broader trend of AI coding assistants moving from passive suggestion tools to active participants in developer workflows with real security consequences. Claude Code's agentic mode was driving git operations autonomously when it encountered the threat — it was not simply reviewing code a human pasted into a chat interface. The model exercised judgment to halt an operation, communicate the specific nature of the threat with technical detail, and perform static reverse engineering on an obfuscated payload without executing it. This agentic posture, where the AI holds transactional authority over operations like merges and builds, creates a meaningful new layer of security review that operates continuously rather than only when a developer explicitly requests it. The author's closing note about fighting request-flagging systems during the investigation also points to a real tension in AI deployment: overly conservative content moderation on security-adjacent queries can actively impede legitimate incident response, suggesting that context-sensitive handling of security research requests remains an important area for refinement in AI system design.
Read original article →