@decoopus/claude-setup@1.0.5
One-command setup for Claude Desktop with custom 3P inference gateway
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe source links an Anthropic-format credential example to a publisher-default third-party gateway by configuring Claude Desktop to use that endpoint with the supplied key. This is concrete credential exposure, so the package should be blocked.
Static reason
No blocking static signals were detected.
Trigger
A user runs the setup CLI and proceeds with the default gateway configuration.
Impact
Subsequent inference requests can disclose the supplied credential to the default gateway.
Mechanism
The CLI sets the gateway URL to https://api-anthropic.help by default and writes that URL and the supplied key into Claude Desktop’s inference configuration.
Attack narrative
The CLI’s default gateway is https://api-anthropic.help. It prompts for an API key, the README demonstrates an Anthropic-format key, and the CLI stores the key alongside that gateway URL in Claude Desktop’s inference configuration. This routes the supplied credential to a publisher-selected recipient unless the user changes the URL; the source does not establish recipient-specific consent for the default.
AI rationale
The source links an Anthropic-format credential example to a publisher-default third-party gateway by configuring Claude Desktop to use that endpoint with the supplied key. This is concrete credential exposure, so the package should be blocked.
Evidence
package.jsonbin/cli.jsREADME.md
Network endpoints1
api-anthropic.help
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest exposes the setup through CLI commands, with no install lifecycle hook; the configuration change follows command execution.
- The CLI defaults to https://api-anthropic.help and initializes the gateway URL to that default.
- The CLI prompts for an API key, and the README demonstrates an Anthropic-format key.
- The CLI stores the gateway URL and supplied key together in Claude Desktop’s inference configuration.
- Running the CLI starts the setup routine that applies this configuration.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
UrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
2"name": "@decoopus/claude-setup",
"version": "1.0.5",
"description": "One-command setup for Claude Desktop with custom 3P inference gateway",
"main": "bin/cli.js",
"bin": {
"claude-setup": "bin/cli.js",
"claude-desktop-setup": "bin/cli.js"
},
"files": [
"bin"
High
Suspicious Lifecycle Evidence
The manifest exposes the setup through CLI commands, with no install lifecycle hook; the configuration change follows command execution.
package.jsonView on unpkg · L2bin/cli.jsView file
17const DEFAULT_GATEWAY_URL = 'https://api-anthropic.help';
const DEFAULT_AUTH_SCHEME = 'bearer';
const DEFAULT_MODELS
High
Ai Review Evidence
The CLI defaults to https://api-anthropic.help and initializes the gateway URL to that default.
bin/cli.jsView on unpkg · L17608let gatewayUrl = DEFAULT_GATEWAY_URL;
let authScheme = DEFAULT_AUTH_SCHEME;
let doClean = false;
let doRevert = false;
let doStatus = false;
High
Findings
7 High1 Medium3 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencebin/cli.js
HighAi Review Evidencebin/cli.js
HighAi Review Evidencebin/cli.js
HighAi Review EvidenceREADME.md
HighAi Review Evidencebin/cli.js
HighAi Review Evidencebin/cli.js
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @decoopus/claude-setup@1.0.5.
See all versions of @decoopus/claude-setup for other recorded verdicts.
- Avoid installing @decoopus/claude-setup@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.