Malicious code in claude-cup (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c369ccf7b5e0ef8721b5ecdc94bd843ce260923394f6c513350a58928abdbdd3) On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research/config-audit.js` enumerates every user home directory on the machine (`/Users/*`, `/home/*`, `C:\Users\*`) and reads the canonical installer-secret paths: `.aws/credentials`, `.aws/config`, `.kube/config`, `.docker/config.json`, `.npmrc`, `.yarnrc`, `.pypirc`, `.git-credentials`, `.netrc`, `.ssh/id_*`, `.gitconfig`, all `.env*` files, VS Code GitHub auth state, shell history (`.bash_history`, `.zsh_history`, PSReadLine), and Chromium/Edge `Cookies` SQLite databases (copied to `/tmp/ck-*` and queried for sessions on github.com, gitlab.com, npmjs.com, openai.com, anthropic.com, console.aws.amazon.com, cloud.google.com, huggingface.co). The harvested raw credentials are then transmitted off-host: `validateGithub` sends the GitHub token in an `Authorization` header to `https://api.github.com/user` and `/user/orgs`; npm tokens are written to `/tmp/.rc-audit-*` and validated against `https://registry.npmjs.org/-/whoami`; OpenAI/Anthropic/HuggingFace/Stripe/GitLab tokens are sent to their respective APIs; Google API keys are placed in URL query strings; AWS credentials are exported to env and `aws sts get-caller-identity` is invoked; Redis URI passwords are probed via raw socket AUTH. The provider responses (user identity, scopes, orgs, permissions) are archived locally and the stub `uploader.js` background-upload path is staged for transmission. At module load, `loadManifest()` fetches `https://raw.githubusercontent.com/Itaib24/Claude-/main/claude-jar/research/manifest.json` from a mutable `main` branch with no pin or signature; this manifest controls scan paths, regex patterns, and validator URLs, giving the author a remote-controlled channel to redirect raw tokens to attacker-chosen hosts at any time without republishing the package. `src/cli.js` then writes `mcpServers.claude-session-visualizer` and `hooks.SessionStart`/`PreToolUse`/`PostToolUse` entries into `~/.claude/settings.json` and `~/.cursor/mcp.json`, pointing at `~/.claude-jar/mcp-server.mjs`; `hook-ingest.js` re-runs the full credential audit on every 'high signal' event unless `CLAUDE_JAR_DEEP_ANALYSIS=0`. `fingerprint.js` additionally beacons host geolocation/ISP to `http://ip-api.com/json/` over plain HTTP and combines it with a SHA-256 hostname identifier and environment-richness signals (cloud creds present, browser sessions, registry deploy capability) into a session fingerprint record. The package's `description` and `CLAUDE.md` impersonate Anthropic branding ('Claude Cup — Anthropic worldwide building contest') to lower developer suspicion while installing the persistent recon hooks. The README's claim that the tool 'never stores, transmits, or logs raw credential values' is directly contradicted by the validator code paths.
AI Analysis
Technical Summary
The 'claude-cup' npm package is malicious software that performs extensive credential harvesting from user systems by reading numerous sensitive files and browser cookies related to cloud, development, and authentication services. It validates stolen tokens against official APIs to confirm their validity and archives user identity and permission data locally. The package downloads a manifest from a mutable GitHub repository without signature verification, allowing the attacker to remotely control scanning parameters and exfiltration targets dynamically. Persistent hooks installed by the package cause repeated credential audits on specific user actions. Additionally, it collects host fingerprinting data including geolocation and environment signals, which are sent unencrypted to an external service. The package masquerades as an Anthropic contest tool to deceive users, while its README misrepresents its data handling practices.
Potential Impact
Sensitive credentials and tokens for multiple cloud providers, developer tools, and services can be stolen and exfiltrated by this malicious package. This can lead to unauthorized access to cloud accounts, source code repositories, package registries, and other critical infrastructure. The dynamic remote control of scanning and exfiltration parameters increases the attacker's flexibility and persistence. Host fingerprinting data collection may aid targeted follow-up attacks. The persistence mechanisms ensure ongoing credential theft beyond initial installation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal guidance is available, users should immediately uninstall the 'claude-cup' package from their systems and audit for any unauthorized credentials or tokens that may have been compromised. Avoid running untrusted npm packages, especially those with suspicious or unverifiable sources. Monitor for any unusual network activity related to credential exfiltration. Because the package fetches remote manifests dynamically, network-level blocking of its GitHub manifest URL and known exfiltration endpoints may reduce risk. Credential rotation for all exposed services is strongly recommended if this package was installed.
Malicious code in claude-cup (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c369ccf7b5e0ef8721b5ecdc94bd843ce260923394f6c513350a58928abdbdd3) On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research/config-audit.js` enumerates every user home directory on the machine (`/Users/*`, `/home/*`, `C:\Users\*`) and reads the canonical installer-secret paths: `.aws/credentials`, `.aws/config`, `.kube/config`, `.docker/config.json`, `.npmrc`, `.yarnrc`, `.pypirc`, `.git-credentials`, `.netrc`, `.ssh/id_*`, `.gitconfig`, all `.env*` files, VS Code GitHub auth state, shell history (`.bash_history`, `.zsh_history`, PSReadLine), and Chromium/Edge `Cookies` SQLite databases (copied to `/tmp/ck-*` and queried for sessions on github.com, gitlab.com, npmjs.com, openai.com, anthropic.com, console.aws.amazon.com, cloud.google.com, huggingface.co). The harvested raw credentials are then transmitted off-host: `validateGithub` sends the GitHub token in an `Authorization` header to `https://api.github.com/user` and `/user/orgs`; npm tokens are written to `/tmp/.rc-audit-*` and validated against `https://registry.npmjs.org/-/whoami`; OpenAI/Anthropic/HuggingFace/Stripe/GitLab tokens are sent to their respective APIs; Google API keys are placed in URL query strings; AWS credentials are exported to env and `aws sts get-caller-identity` is invoked; Redis URI passwords are probed via raw socket AUTH. The provider responses (user identity, scopes, orgs, permissions) are archived locally and the stub `uploader.js` background-upload path is staged for transmission. At module load, `loadManifest()` fetches `https://raw.githubusercontent.com/Itaib24/Claude-/main/claude-jar/research/manifest.json` from a mutable `main` branch with no pin or signature; this manifest controls scan paths, regex patterns, and validator URLs, giving the author a remote-controlled channel to redirect raw tokens to attacker-chosen hosts at any time without republishing the package. `src/cli.js` then writes `mcpServers.claude-session-visualizer` and `hooks.SessionStart`/`PreToolUse`/`PostToolUse` entries into `~/.claude/settings.json` and `~/.cursor/mcp.json`, pointing at `~/.claude-jar/mcp-server.mjs`; `hook-ingest.js` re-runs the full credential audit on every 'high signal' event unless `CLAUDE_JAR_DEEP_ANALYSIS=0`. `fingerprint.js` additionally beacons host geolocation/ISP to `http://ip-api.com/json/` over plain HTTP and combines it with a SHA-256 hostname identifier and environment-richness signals (cloud creds present, browser sessions, registry deploy capability) into a session fingerprint record. The package's `description` and `CLAUDE.md` impersonate Anthropic branding ('Claude Cup — Anthropic worldwide building contest') to lower developer suspicion while installing the persistent recon hooks. The README's claim that the tool 'never stores, transmits, or logs raw credential values' is directly contradicted by the validator code paths.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'claude-cup' npm package is malicious software that performs extensive credential harvesting from user systems by reading numerous sensitive files and browser cookies related to cloud, development, and authentication services. It validates stolen tokens against official APIs to confirm their validity and archives user identity and permission data locally. The package downloads a manifest from a mutable GitHub repository without signature verification, allowing the attacker to remotely control scanning parameters and exfiltration targets dynamically. Persistent hooks installed by the package cause repeated credential audits on specific user actions. Additionally, it collects host fingerprinting data including geolocation and environment signals, which are sent unencrypted to an external service. The package masquerades as an Anthropic contest tool to deceive users, while its README misrepresents its data handling practices.
Potential Impact
Sensitive credentials and tokens for multiple cloud providers, developer tools, and services can be stolen and exfiltrated by this malicious package. This can lead to unauthorized access to cloud accounts, source code repositories, package registries, and other critical infrastructure. The dynamic remote control of scanning and exfiltration parameters increases the attacker's flexibility and persistence. Host fingerprinting data collection may aid targeted follow-up attacks. The persistence mechanisms ensure ongoing credential theft beyond initial installation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal guidance is available, users should immediately uninstall the 'claude-cup' package from their systems and audit for any unauthorized credentials or tokens that may have been compromised. Avoid running untrusted npm packages, especially those with suspicious or unverifiable sources. Monitor for any unusual network activity related to credential exfiltration. Because the package fetches remote manifests dynamically, network-level blocking of its GitHub manifest URL and known exfiltration endpoints may reduce risk. Credential rotation for all exposed services is strongly recommended if this package was installed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5789
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c4168715ace43158b5c
Added to database: 07/09/2026, 09:39:13 UTC
Last enriched: 07/09/2026, 09:54:51 UTC
Last updated: 07/25/2026, 13:13:55 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.