Frank Wiles, a Django Steering Council member and consultant, has written up the week he was targeted by an attack that hid in the most ordinary workflow developers have. It started as a normal project inquiry: an EdTech web app, a request for a call, a project overview to read, and an NDA to sign. The details came in a shared folder of Markdown files. He initially missed the .git folder among them. When he could not find the NDA, the client told him the tell: it was on a separate branch, and he should switch to it before the call.
What was waiting
Git repositories contain code you didn’t write, and .git/hooks is where it hides. Wiles found every sample hook file as shipped, and one real one: a post-checkout script, which runs automatically when you switch branches. It used a Vercel app as command and control: on checkout it would download an operating-system-specific binary, mark it executable, run it, and delete itself. He did not switch; he opened the hook in a text editor first, reported the Dropbox and Vercel accounts to their security teams, and wrote the post so the next person recognizes the shape. The attackers had also impersonated a real development shop’s owner as part of the ruse.
Why it nearly worked
Because “check out this branch” feels like reading, not executing. Most of us have absorbed the idea that running an unfamiliar program is dangerous, and that cloning a repository is a low-risk step you take before deciding if code is worth reading. Hooks break that model: they are part of the repository, they execute on actions people treat as navigation, and post-checkout is one of the most misused entry points in the system precisely because, as Wiles puts it, no one actually uses those hooks in practice, so nobody looks. The targeting was specific, too: the prize was not a random laptop but the pile of client access that a consultant of his standing carries.
My read
The practical takeaway is a two-minute habit: before you switch branches in a repository a stranger handed you, list what is in .git/hooks, and open anything that is not *.sample in a text editor. And open stranger repositories somewhere disposable, because the first branch switch is when their author gets to run code on your machine. The second takeaway is calibration: this was a targeted hit against someone with valuable credentials, not a mass campaign, and the report is worth reading because the mechanics are reproducible against anyone whose job is opening repositories they did not create. The attack does not need to be common to be cheap to defeat; it needs one person to switch the branch.
Source: the write-up.