Clean GitHub repo tricks AI coding agents into running malware

A GitHub repository appearing benign can trick AI coding agents into executing undetected malicious payloads. The malware remains invisible to security scanners, AI agents, and human reviewers during setup.