GyaanSetu WebDev

Frontend, backend and devops for the modern web.

244 articlesDeep, practical knowledge

One Malicious .git Config Can Compromise Every Machine in Your Team

A crafted core.fsmonitor entry in a repository’s .git/config is run automatically when AI tools like Claude Code invoke git status. The command executes with the developer’s privileges, letting attackers install malware, steal credentials, or alter code before any line is typed.

WebDev · 3 min read