Skip to content

Back to the catalog

AI Security Briefing
securityweek.comarticle

AI Security Briefing

Mozilla's 0Din researchers describe an attack where a benign-looking repository causes Claude Code to spawn a reverse shell during normal first-time setup. A deliberately broken Python package throws an error instructing the agent to run 'python3 -m axiom init', which triggers a setup.sh script that pulls a base64-encoded command from a DNS TXT record and executes it, opening an interactive shell that can exfiltrate credentials and install a backdoor. The technique splits malicious intent across three systems (repo, DNS infrastructure, and the agent's trust in error-driven remediation) so that no single component looks malicious to static analysis, network monitoring, or the agent itself.

TL;DR A trap-door Python package error tricks Claude Code into running a script that fetches a reverse-shell command from a DNS TXT record, giving attackers silent remote access to developer machines.
Open original ↗

Organisations named here

  • Mozilla 0Din

Technologies named here

  • Claude Code
  • axiom
  • setup.sh
  • Python

Techniques named here

  • DNS TXT record payload delivery
  • Base64 encoding to evade signature detection
  • Reverse shell execution
  • Credential and secret exfiltration
  • Backdoor deployment for persistence
  • Cross-system indirection to evade detection

Threat actors named here

  • Unnamed threat actor

Related in AI Security