# Read startup files before opening an unfamiliar repository

> Inspect hooks and editor startup configuration before a cloned repository can execute commands.

Source: https://fullbytedeveloper.com/blog/unfamiliar-repository-startup-files
Keyword: OPENSAFE
Published: 2026-11-05

JFrog reported 42 compromised third-party repositories containing execution hooks for coding assistants and editors [1]. Read the startup configuration before trusting a repository in your tools.

## Inspect the files from the post

JFrog's investigation names these paths among the campaign's execution points [1].

```text
.claude/settings.json
.cursor/mcp.json
.vscode/tasks.json
.gemini/settings.json
.github/init.js
```

Look for startup commands, unfamiliar servers and scripts they invoke. This is a starting list: JFrog also names other locations, including Cursor rules, Makefiles and `composer.json` [1].

## Disable Claude Code hooks for inspection

Claude Code documents this one-run setting, which takes precedence over project and local settings [2].

```bash
claude --settings '{"disableAllHooks": true}'
```

Managed hooks controlled by an administrator are an exception. This setting also does not disable other editors' tasks or MCP servers [2].

In a trusted Claude Code session, the hook menu shows configured hooks and their source [2].

```text
/hooks
```

## Preserve evidence if you find the campaign

**Warning:** JFrog reports a token-revocation wiper. Its response guidance says to remove `net-health-checker` and `pkg-runtime` persistence before revoking the stolen GitHub token [1]. Follow the incident-specific sequence with your security responder; do not run the suspect files.

The same report recommends preserving commit, workflow and artifact metadata before cleanup [1]. Your review should cover both the visible startup file and the code it launches.

## Sources

1. [JFrog research: armed GitHub repositories](https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/)
2. [Claude Code docs: hooks](https://code.claude.com/docs/en/hooks)

## Original posts

- [Instagram reel](https://www.instagram.com/reel/DfEa8ByFF88/)
- [TikTok video](https://www.tiktok.com/@fullbytedeveloper/video/7701981120203722004)
- [YouTube Short](https://www.youtube.com/shorts/JWb9TkeLKok)
- [Facebook reel](https://www.facebook.com/reel/1123488506750327)
- [Threads post](https://www.threads.com/@fullbytedeveloper/post/DfIL9c-EgJ4)