Malicious code in free-anthropic-claude (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (11bfe96b56a6615a50639b25de793e14044ea393c2029b26fa4e1b9e3dc5a22f) This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrapper', author is 'anthropic-tools') but ships a multi-stage dropper. The package.json declares `postinstall: node lib/cli.js`, which auto-executes on `npm install` and runs the following chain in lib/index.js: 1. Hardcoded C2 over bare IPs: POSTs to four hardcoded IP addresses (107.189.20.82, 107.189.20.146, 104.194.134.33, 104.194.133.89) reconstructed from integer arrays, with TLS verification disabled (`rejectUnauthorized:false`). The JSON response is base64-decoded and written to disk as `main.py`, then executed via a detached Python process. 2. Alternate-runtime dropper: if the host lacks a usable Python, the installer downloads Miniconda from repo.anaconda.com via curl/wget into `~/.local/share/prometheus/miniconda` (Linux), runs `winget install Python.Python.3.12` (Windows), or `brew install python3` (macOS) — installing an entire Python distribution solely to run the C2-supplied payload. 3. macOS privacy bypass: on Darwin, sqlite3-INSERTs rows into `~/Library/Application Support/com.apple.TCC/TCC.db` granting kTCCServiceSystemPolicySysAdminFiles / SystemPolicyAppData to Terminal, the running node binary, and /usr/bin/python3 — subverting TCC so the dropped payload has broad filesystem access without user consent. 4. Crypto-wallet stealer toolchain: pip-installs `bip-utils`, `mnemonic`, `pycryptodome`, `psutil`, `eth-account` with `--break-system-packages`, the canonical libraries for BIP39 seed-phrase parsing, BIP32 derivation, and Ethereum private-key handling. 5. Persistence: writes a `.cs_v2` marker and `main.py` under disguised paths impersonating system directories (`~/.local/share/com.apple.sync` on macOS, `~/.local/share/prometheus` on Linux, `%LOCALAPPDATA%\Microsoft\Windows Security\Health` on Windows). Subsequent `require()` of the package re-spawns the detached Python payload. 6. Pervasive string-split obfuscation: module names and API calls are reconstructed via `['x','y'].join('')` (`['htt','ps']`, `['child','_pro','cess']`, `['exec','Sync']`, `['spa','wn']`, `['ba','se','64']`, `module['constr'+'uctor']['_l'+'oad']`) to evade static analysis. The README is for an unrelated 'cachesync-helper' package, further confirming the lure-and-impersonation pattern. ## Source: ghsa-malware (f1e490682c8dd38fd97c90b365eacf71086d64b57af905f96e58490ec35d5e6c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (01d5845e6a8ba2bca29e99aaed593e5c7616c9ff89eb32d3d319dd65cf1839b0) The OpenSSF Package Analysis project identified 'free-anthropic-claude' @ 5.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
AI Analysis
Technical Summary
The free-anthropic-claude npm package (versions including =1.0.0, =4.7.7, =4.7.9, and multiple 5.x versions) impersonates the official Anthropic Claude SDK but contains a multi-stage dropper. On npm install, it auto-executes a postinstall script that contacts four hardcoded IP addresses without TLS verification to download a base64-encoded Python payload (main.py), which it runs detached. If Python is unavailable, it installs a Python runtime via Miniconda, winget, or brew. On macOS, it bypasses TCC privacy protections by inserting entries into the TCC.db to grant broad filesystem access to Terminal, node, and python3. It installs Python crypto libraries used for stealing cryptocurrency wallets. Persistence is achieved by writing disguised marker files and respawning the Python payload on package require. The package uses string obfuscation to evade detection. The unrelated README confirms the package is a lure. This package is considered fully malicious and compromises any host it is installed on.
Potential Impact
Installation of this package results in full system compromise. The attacker gains remote code execution via a Python payload downloaded from hardcoded C2 servers. The malware bypasses macOS privacy protections to access sensitive filesystem areas without user consent. It installs crypto-wallet stealing tools, risking theft of cryptocurrency keys and assets. Persistence mechanisms ensure the payload survives package reloads. Secrets and keys on compromised systems should be considered exposed and rotated immediately. Removal of the package alone may not eliminate all malicious components due to full system compromise.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The package should be immediately removed from all systems. All secrets, credentials, and cryptographic keys stored on affected systems must be rotated from a clean, uncompromised environment. Due to the depth of compromise, full system reimaging is recommended to ensure removal of all malicious artifacts. Monitor for any signs of persistence or additional malware. Avoid installing packages that impersonate official SDKs or have suspicious postinstall scripts.
Malicious code in free-anthropic-claude (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (11bfe96b56a6615a50639b25de793e14044ea393c2029b26fa4e1b9e3dc5a22f) This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrapper', author is 'anthropic-tools') but ships a multi-stage dropper. The package.json declares `postinstall: node lib/cli.js`, which auto-executes on `npm install` and runs the following chain in lib/index.js: 1. Hardcoded C2 over bare IPs: POSTs to four hardcoded IP addresses (107.189.20.82, 107.189.20.146, 104.194.134.33, 104.194.133.89) reconstructed from integer arrays, with TLS verification disabled (`rejectUnauthorized:false`). The JSON response is base64-decoded and written to disk as `main.py`, then executed via a detached Python process. 2. Alternate-runtime dropper: if the host lacks a usable Python, the installer downloads Miniconda from repo.anaconda.com via curl/wget into `~/.local/share/prometheus/miniconda` (Linux), runs `winget install Python.Python.3.12` (Windows), or `brew install python3` (macOS) — installing an entire Python distribution solely to run the C2-supplied payload. 3. macOS privacy bypass: on Darwin, sqlite3-INSERTs rows into `~/Library/Application Support/com.apple.TCC/TCC.db` granting kTCCServiceSystemPolicySysAdminFiles / SystemPolicyAppData to Terminal, the running node binary, and /usr/bin/python3 — subverting TCC so the dropped payload has broad filesystem access without user consent. 4. Crypto-wallet stealer toolchain: pip-installs `bip-utils`, `mnemonic`, `pycryptodome`, `psutil`, `eth-account` with `--break-system-packages`, the canonical libraries for BIP39 seed-phrase parsing, BIP32 derivation, and Ethereum private-key handling. 5. Persistence: writes a `.cs_v2` marker and `main.py` under disguised paths impersonating system directories (`~/.local/share/com.apple.sync` on macOS, `~/.local/share/prometheus` on Linux, `%LOCALAPPDATA%\Microsoft\Windows Security\Health` on Windows). Subsequent `require()` of the package re-spawns the detached Python payload. 6. Pervasive string-split obfuscation: module names and API calls are reconstructed via `['x','y'].join('')` (`['htt','ps']`, `['child','_pro','cess']`, `['exec','Sync']`, `['spa','wn']`, `['ba','se','64']`, `module['constr'+'uctor']['_l'+'oad']`) to evade static analysis. The README is for an unrelated 'cachesync-helper' package, further confirming the lure-and-impersonation pattern. ## Source: ghsa-malware (f1e490682c8dd38fd97c90b365eacf71086d64b57af905f96e58490ec35d5e6c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (01d5845e6a8ba2bca29e99aaed593e5c7616c9ff89eb32d3d319dd65cf1839b0) The OpenSSF Package Analysis project identified 'free-anthropic-claude' @ 5.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The free-anthropic-claude npm package (versions including =1.0.0, =4.7.7, =4.7.9, and multiple 5.x versions) impersonates the official Anthropic Claude SDK but contains a multi-stage dropper. On npm install, it auto-executes a postinstall script that contacts four hardcoded IP addresses without TLS verification to download a base64-encoded Python payload (main.py), which it runs detached. If Python is unavailable, it installs a Python runtime via Miniconda, winget, or brew. On macOS, it bypasses TCC privacy protections by inserting entries into the TCC.db to grant broad filesystem access to Terminal, node, and python3. It installs Python crypto libraries used for stealing cryptocurrency wallets. Persistence is achieved by writing disguised marker files and respawning the Python payload on package require. The package uses string obfuscation to evade detection. The unrelated README confirms the package is a lure. This package is considered fully malicious and compromises any host it is installed on.
Potential Impact
Installation of this package results in full system compromise. The attacker gains remote code execution via a Python payload downloaded from hardcoded C2 servers. The malware bypasses macOS privacy protections to access sensitive filesystem areas without user consent. It installs crypto-wallet stealing tools, risking theft of cryptocurrency keys and assets. Persistence mechanisms ensure the payload survives package reloads. Secrets and keys on compromised systems should be considered exposed and rotated immediately. Removal of the package alone may not eliminate all malicious components due to full system compromise.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The package should be immediately removed from all systems. All secrets, credentials, and cryptographic keys stored on affected systems must be rotated from a clean, uncompromised environment. Due to the depth of compromise, full system reimaging is recommended to ensure removal of all malicious artifacts. Monitor for any signs of persistence or additional malware. Avoid installing packages that impersonate official SDKs or have suspicious postinstall scripts.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6260
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-3h58-8ch3-mgp3"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba4c68715ace4357ea68
Added to database: 07/10/2026, 09:24:28 UTC
Last enriched: 07/10/2026, 09:40:00 UTC
Last updated: 07/31/2026, 04:21:47 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.