> Clone the GitHub repo, do a security audit with Claude Code, build from source, update manually
> Clone the GitHub repo, do a security audit with Claude Code, build from source, update manually
See also:
- [0-Days \ red.anthropic.com]( https://red.anthropic.com/2026/zero-days/ )
EDIT: The main challenge here is more likely to be the noise, as the LLM is more likely to flag too much than too little, so I'd recommend putting together a prompt that has it group whatever it finds by severity and likelihood of malicious intent.
EDIT 2: Re Anthropic link above – worth pointing out that finding intentionally introduced malware when you have access to the source code and git history is a hell of a lot easier than finding a 0-day. The malware has to exfil data eventually or do ransomware stuff, good luck hiding that without raising the alarm, plus any attempt at aggressive obfuscation will raise the alarm on its own. I'm not saying it's impossible, I am saying that I think it's very very hard.