Criminals used the leaked Claude Code source code to publish fake installers (Windows executables) containing the Vidar trojan on GitHub, one of which gained more than 500 stars; the incident was discovered by researchers at security firm Zscaler.