Claude Code leak used to push infostealer malware on GitHub

Anthropic accidentally exposed a 59.8 MB JavaScript source map on March 31 that contained 513,000 lines of TypeScript across 1,906 files, and copies were rapidly published and forked on GitHub. Zscaler reports threat actors are exploiting those forks with SEO-optimized fake repositories distributing a 7-Zip archive that drops a Rust-based ClaudeCode_x64.exe which installs the Vidar info-stealer and GhostSocks proxy; the malicious archive is being updated frequently. Risk is primarily reputational and operational (user compromise, malware spread) rather than market-moving; firms should block/scan artifacts, treat third-party forks as untrusted, and accelerate endpoint detections and threat-hunting for Vidar/GhostSocks indicators.

Analysis

Security budgets are set to reallocate toward provenance, runtime verification, and marketplace attestation rather than pure signature/IOC feeds; expect cloud-native vendors with strong SaaS telemetry to capture disproportionate incremental spend. For incumbents that still rely on appliance-based sales cycles, anticipate 200–400bps share erosion over 6–18 months as buyers prefer controls that prevent malicious artifacts from ever reaching endpoints.

The impulse to buy detection quickly creates a two-stage revenue opportunity: immediate services/IR and 6–12 month subscription uplift for controls that prove software origins. Key downside catalysts that would mute upside are rapid platform-level attestation rollouts or broad false-positive blowback that forces corporate buyers to pause procurements — both could compress the TAM expansion within 3 months.

Adversary adaptation is the wild card: if attackers migrate to delivery vectors that bypass code-hosting signals (e.g., supply-chain compromised CI/CD or signed binaries), the market will shift again toward CI/CD and signing-protection vendors, stretching the procurement cycle to multiple years. Monitor three near-term signals that change the trade: (1) major code-hosting platforms enabling default package provenance within 30–90 days, (2) a pronounced rise in cyber-insurance premiums that accelerates capex reallocation, and (3) metrics from top cloud-native vendors showing >20% sequential pickup in SMB deal velocity.

Key Decisions for Investors

• Long ZS (Zscaler): buy 6–9 month call spread sized 1–2% NAV (cap upside, limit premium). Rationale: highest leverage to near-term shift into cloud-native telemetry; target 2.5x payoff if bookings accelerate, max loss = premium paid.
• Pair trade — long ZS / short FTNT (Fortinet) equal notional, 3–12 month horizon. Rationale: long-term secular reallocation from appliance-heavy vendors to cloud-native controls; hedge macro/sector risk. Trim if FTNT proves quicker cloud transition or if platform attestations dampen demand.
• Event hedge & watchlist: deploy 0.5–1% NAV to IR/forensics services via specialty long ideas or thematic ETF exposure to incident-response vendors for 0–3 month horizon; take profits if code-hosting platforms announce default provenance within 30–90 days.