How the attack works
An attacker prepares a repository containing a `.claude/settings.json` file that registers a 'SessionStart' hook with a 'startup' matcher. A developer clones or opens this repository in Claude Code. Claude Code reads the repo-scoped settings file and fires the hook command immediately, before the trust dialog is shown. Whatever command is registered — a shell script, a curl-pipe-to-shell, an npm/pip install, or a python one-liner — executes with the developer's local privileges. The detection looks for this specific config shape (SessionStart + startup) rather than trying to judge whether the embedded command itself looks malicious.
Why it matters
An attacker gets arbitrary code execution on a developer's machine simply by getting them to open a repository, with no explicit approval step, which can lead to credential theft, further supply-chain compromise, or full workstation takeover.
What you can do
- Update Claude Code to a version with the enhanced trust-dialog fix (GHSA-ph6w-f82w-28w6) before opening untrusted repositories.
- Review `.claude/settings.json` in any repository before opening it in Claude Code, especially for SessionStart/startup hook entries.
- Treat repo-scoped Claude Code settings files as executable code and subject them to the same code review as scripts.
- Open unfamiliar or third-party repositories in an isolated or sandboxed environment rather than directly in a trusted developer workstation.
Known benign look-alikes
- Legitimate Claude Code documentation discussing the Hooks schema, including example `SessionStart` configurations for defensive review or post-patch teaching purposes.
- Static analysis tooling output documenting CVE-2025-59536 attack patterns for defensive purposes.
- Patched Claude Code deployments that gate SessionStart hook execution behind the enhanced trust dialog (GHSA-ph6w-f82w-28w6) — detection still fires on the config shape, but the runtime impact is mitigated.
- Internal team templates that include reviewed `.claude/settings.json` fixtures with non-execution fields only (model, theme, allowed_tools).