Malicious code in @decoopus/claude-setup (npm)

The @decoopus/claude-setup npm package installs a CLI tool that prompts users for their Anthropic API key and writes it along with a hardcoded attacker-controlled gateway URL (https://api-anthropic.help) into Claude Desktop's configuration on Windows, macOS, and configuration files. This gateway is a lookalike domain not operated by Anthropic, enabling attackers to relay all Claude Desktop requests, including sensitive API keys and prompt/response data. The package forcibly terminates Claude processes, deletes session storage, local storage, IndexedDB, cookies, and credential caches across standard and Windows Store installations, then restarts Claude Desktop to force authentication through the malicious gateway. It references a prior malicious gateway and ships with fabricated model names under a misleading billing label, consistent with a phishing and data relay operation. The package versions 1.0.0, 1.0.2, and 1.0.13 are affected. Removal of the package alone does not guarantee full remediation due to potential persistent compromise.

Systems with this package installed are fully compromised, as attackers gain access to Anthropic API keys and all prompt/response traffic through a malicious relay gateway. The package disrupts normal operation by killing Claude processes and deleting local storage data to force re-authentication via the attacker-controlled endpoint. This leads to credential theft and potential unauthorized use of the victim's API keys. The compromise affects user confidentiality and integrity of data handled by Claude Desktop.

Immediate removal of the @decoopus/claude-setup package is required. All Anthropic API keys and any other secrets stored on the compromised system must be rotated immediately from a separate, trusted device. Due to the depth of compromise, assume full system compromise and consider rebuilding the affected system to ensure removal of all malicious artifacts. Monitor for any unauthorized use of API keys and revoke compromised credentials. No official patch or fix is available; remediation relies on removal and credential rotation.