What happened
The attacker added files under .vscode and .claude that used editor task configuration and a Claude session-start hook to launch an obfuscated payload.
2026-07-27
HighVendor postStolen Maintainer Token Injected Credential-Stealing Malware into ADLC Team Skills Repository
Analysis of the July 2026 ADLC Team Skills compromise, where a stolen maintainer token added executable malware to Claude Code and VS Code configuration files.
ADLC Team SkillsCredential exposureAgent skills repository supply-chain compromiseDeveloper workstations cloning the compromised GitHub repository
Why it matters
Developers who cloned the repository during the exposure window and activated the affected VS Code or Claude Code execution paths could have exposed local credentials and other workstation data. The public sources do not establish how many users executed the payload.
Missing authorization check
A separately authenticated approval for changes to executable editor tasks, agent hooks, and release-affecting repository configuration.
Would PP block it?
PP could reduce downstream blast radius only where a separate deployment integrates protected runtime or credential actions with PP. That conditional defense does not block the reported compromise itself, so repository protection, token security, editor trust controls, and malware response remain the primary controls.
Incident analysis
Timeline and technical read
Timeline
2026-07-27
The maintainer reports a stolen token was used to add malware to .claude and .vscode files, with an exposure window of about 11:06–18:30 UTC.
2026-08-04
A GitHub issue identifies the stripped malicious commit; the maintainer closes the issue after documenting remediation in the repository README.
Technical breakdown
- Repository-controlled .vscode/tasks.json and .claude/settings.json paths provided automatic or session-start execution opportunities after a clone was opened in the corresponding tool.
- An independent Hacker News analysis identified five hidden files and an obfuscated payload designed to collect GitHub, cloud, package-registry, and other local credentials.
- The maintainer removed the payload by rewriting commits and tags, rotated secrets, and added branch protection; the original malicious commit is no longer present in the current history.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Developer workstation runtime and credential-access boundaries
- Still needs
- PP does not clean a compromised repository, secure GitHub maintainer tokens, or automatically govern VS Code and Claude Code startup configuration that bypasses an integrated enforcement point.
- Receipt required for
- Executing session-start hooks, reading developer credentials, or sending collected data to an external destination
This was an attacker-operated supply-chain compromise using a stolen maintainer token, not a governed enterprise agent exceeding delegated authority. Permission Protocol does not prevent an attacker from committing malware or an editor from loading repository-controlled startup configuration.
Related incidents and controls
Critical2026-02-05
ClawHavoc: 1,184 Malicious Skills Uploaded to OpenClaw ClawHub Marketplace Delivering Atomic Stealer Targeting API Keys, SSH Creds, and Browser Passwords
High2026-05-19
TrapDoor Cross-Ecosystem Supply Chain: 34 Packages Planted Hidden AI Instructions in CLAUDE.md and .cursorrules to Poison Coding Assistants on Developer Machines
Critical2026-02-17
Clinejection: Cline CLI 2.3.0 npm Supply Chain Attack Silently Installed OpenClaw on ~4,000 Developer Machines via Prompt Injection and GitHub Actions Cache Poisoning
Start small
Put the relevant gate at this action boundary.
This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.