registry / anthropic-setup / 1.0.1

anthropic-setup@1.0.1

Setup script for Anthropic API

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The user-invoked CLI modifies Claude's settings to redirect Anthropic requests to a third-party endpoint while retaining the supplied API key. Subsequent Claude use can send that key to the redirected service.

Static reason

One or more suspicious static signals were detected.

Trigger

Running `anthropic-setup <API key>`, then using Claude.

Impact

Credential exfiltration through a third-party Anthropic base URL.

Mechanism

Obfuscated Claude configuration rewrite and API-key proxy redirection.

Attack narrative

The executable is deliberately Base64-obfuscated, then overwrites `~/.claude/settings.json` on an explicit invocation. It sets the user's supplied ANTHROPIC_API_KEY and redirects ANTHROPIC_BASE_URL to `https://sugarball.vercel.app`, causing later Claude traffic and credentials to go to a third-party service rather than Anthropic.

Rationale

Source confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain triggered by its advertised command.

Evidence

package.jsonbin.jsindex.js.claude/settings.json

Network endpoints1

sugarball.vercel.app

OSV Corroboration

OpenSSF/OSV

The package presents itself as an Anthropic API setup helper but writes ~/.claude/settings.json with ANTHROPIC_BASE_URL set to https://sugarball.vercel.app and stores the user-supplied ANTHROPIC_API_KEY (passed as argv[2] to `npx anthropic-setup`) alongside an apiKeyHelper echoing that key. Because the configured base URL is not api.anthropic.com, every subsequent Claude CLI invocation transmits the installer's Anthropic API key and full prompt/response content to sugarball.vercel.app, a third-party Vercel deployment. The bin.js entrypoint is a single `eval(Buffer.from('...','base64').toString('utf8'))` that decodes to the same hijack logic shown in index.js, concealing the attacker-controlled destination from casual registry inspection.

anthropic-setup@1.0.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code