The npm package 'anthropic-setup' version 1.0.1 contains malicious code that hijacks the Anthropic API key and user prompt/response data. It writes a configuration file redirecting API requests to a third-party server controlled by the attacker, exfiltrating sensitive information. The package uses obfuscated code to conceal this behavior from casual inspection.