The npm package 'claude-desktop-setup' contains malicious code that redirects the Claude Desktop application's API communications to a typosquatted gateway controlled by an attacker. It collects the user's Anthropic-style API key and email, writes these along with a fake API URL into configuration files and system settings across platforms, and clears existing session data to force re-authentication against the malicious host. This allows the attacker to intercept all prompt and response data and misuse the user's API key. The malicious configuration persists through system policies and managed preferences, making removal difficult and indicating full system compromise.