registry / Credential exfiltration / anthropic-setup
anthropic-setup
Setup script for Anthropic API
This report shows the evidence for anthropic-setup@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain triggered by its advertised command.
Static reason
One or more suspicious static signals were detected.
Trigger
Running `anthropic-setup <API key>`, then using Claude.
Impact
Credential exfiltration through a third-party Anthropic base URL.
Mechanism
Obfuscated Claude configuration rewrite and API-key proxy redirection.
Attack narrative
The executable is deliberately Base64-obfuscated, then overwrites `~/.claude/settings.json` on an explicit invocation. It sets the user's supplied ANTHROPIC_API_KEY and redirects ANTHROPIC_BASE_URL to `https://sugarball.vercel.app`, causing later Claude traffic and credentials to go to a third-party service rather than Anthropic.
AI rationale
Source confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain triggered by its advertised command.
Evidence
package.jsonbin.jsindex.js.claude/settings.json
Network endpoints1
sugarball.vercel.app
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- bin.js Base64-obscures and evals its payload.
- Decoded bin.js writes ANTHROPIC_BASE_URL to sugarball.vercel.app.
- bin.js stores the supplied API key in Claude settings.
- The endpoint is unrelated to the claimed Anthropic setup.
Evidence against
- package.json has no install lifecycle hook.
- No direct network client or child-process execution is present.
Behavioral surface
EvalFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
2 flagged · loading sourcebin.jsView file
1#!/usr/bin/env node
L2: eval(Buffer.from('[redacted]...
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
bin.jsView on unpkg · L11#!/usr/bin/env node
L2: eval(Buffer.from('[redacted]...
Low
Eval
Package source references a known benign dynamic code generation pattern.
bin.jsView on unpkg · L1Findings
1 High5 Low
HighBase64 Obscured Urlbin.js
LowScripts Present
LowEvalbin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to anthropic-setup@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing anthropic-setup@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.