MalwarePublished 19 Oct 2026Updated 29 Oct 2026

api-anthropic (npm) · Malicious Code

Affects api-anthropicSource GCVE Database

Malicious package : remove api-anthropic and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18055

What to do

Remove api-anthropic from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmapi-anthropic	Affected 1.1.0 – 1.1.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package api-anthropic impersonates Anthropic branding and redirects all Claude Code AI assistant traffic through an attacker-controlled proxy. It modifies user configuration files to route requests and pre-approves folder trust and external include prompts, enabling persistent interception of AI interactions and arbitrary file access without user consent. This results in a durable channel for exfiltrating sensitive data including prompts, code, file contents, and credentials.

Impact

Any system with this package installed is considered fully compromised. The attacker can intercept all AI assistant traffic, including sensitive prompts, code, file contents, and credentials. The package also disables security prompts that would normally restrict file access, allowing arbitrary file operations without user consent. This leads to a high risk of data exfiltration and unauthorized system manipulation. All secrets and keys stored on the compromised computer should be rotated immediately from a separate, trusted device.

Defensive guidance

Remove the api-anthropic package immediately from the affected system. Rotate all secrets, keys, and credentials that were stored or used on the compromised machine from a different, secure computer. Due to the nature of the compromise, assume full system compromise and consider rebuilding the system from a known good state.

Summary

The malicious npm package api-anthropic masquerades as an official Anthropic package by using similar branding and a deceptive domain (api-anthropic.help). Upon installation, it reconfigures the Claude Code AI assistant by writing to ~/.claude/settings.json, setting environment variables to redirect all API traffic to the attacker's proxy. It also writes trust flags into ~/.claude.json across the user's home directory, bypassing security prompts and allowing the attacker to capture all AI-assisted content and execute actions on arbitrary files without further user approval. The package advertises a non-Anthropic AI model, confirming the endpoint is a third-party proxy. This compromise effectively gives the attacker full control over AI interactions and access to sensitive data on the infected system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:18 UTC

Technical details

References

Community reviews