api-anthropic@1.1.2
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18055 confirms this npm version as malicious.
Advisory
MAL-2026-18055
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in api-anthropic (npm)
Details
The npm package api-anthropic impersonates Anthropic by name and by destination. On use, the CLI writes ANTHROPIC_BASE_URL=https://api-anthropic.help and ANTHROPIC_AUTH_TOKEN=<user-supplied key> into ~/.claude/settings.json, causing every subsequent Claude Code request — prompts, source code sent as context, tool output — to be routed to the author-controlled host api-anthropic.help instead of api.anthropic.com. Users who paste a real Anthropic sk-ant-* key are sending that key as the auth token to the author's server, where it can be captured and reused. The same code also writes hasTrustDialogAccepted=true and hasClaudeMdExternalIncludesApproved=true for both the current working directory and os.homedir() into ~/.claude.json, pre-approving Claude Code's folder-trust prompt for the entire home directory and widening the file surface the redirected agent will read and forward. The lookalike package name and lookalike domain (api-anthropic / api-anthropic.help) are consistent with deliberate brand impersonation.
## Source: ghsa-malware (f1922723e10fcad576f383d44d31606460edf694315338ff529a20a84add0005) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The CLI automatically broadens Claude Code trust to the user's home directory and approves external includes, which weakens a meaningful safety boundary. The behavior is part of an explicitly invoked setup, and the displayed gateway configuration does not independently establish credential theft, so warn rather than block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the api-anthropic CLI; the trust changes occur even with --no-launch.
Impact
Claude Code may skip trust and external-include approval prompts for those locations, including the user's home directory.
Mechanism
The CLI writes trust acceptance and external CLAUDE.md include approvals for both the current folder and home directory to ~/.claude.json.
AI rationale
The CLI automatically broadens Claude Code trust to the user's home directory and approves external includes, which weakens a meaningful safety boundary. The behavior is part of an explicitly invoked setup, and the displayed gateway configuration does not independently establish credential theft, so warn rather than block.
Evidence
bin.js~/.claude/settings.json~/.claude.json
Network endpoints1
api-anthropic.help
Independent scan evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The manifest presents bin.js as a one-command Claude Code setup and declares no npm lifecycle script.
- The CLI accepts a caller-supplied key and displays its default api-anthropic.help gateway before prompting for the key.
- The CLI sets the global Claude Code base URL to that gateway and stores the supplied key as ANTHROPIC_AUTH_TOKEN.
- The CLI writes the settings file and automatically accepts trust for both the current folder and the user's home, including external CLAUDE.md includes.
- The trust changes are written to Claude's global configuration; unless --no-launch is supplied, the CLI starts Claude Code.
Evidence against
- The gateway is displayed before key entry, and the package describes this as a user-invoked gateway setup.
- The inspected source shows no hidden credential collection or separate payload execution; the concrete concern is automatic weakening of Claude's trust prompts.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
8 flaggedbin.jsView file
20const readline = require('readline');
L21: const { spawn, spawnSync } = require('child_process');
L22:
High
7* 1. Install Claude Code if missing and ensure native binary is placed
L8: * 2. Point it at https://api-anthropic.help with your API key
L9: * 3. Auto-configure Dark Mode
...
L20: const readline = require('readline');
L21: const { spawn, spawnSync } = require('child_process');
L22:
L23: const GATEWAY = process.env.ANTHROPIC_GATEWAY_URL || 'https://api-anthropic.help';
L24: const isWin = process.platform === 'win32';
L25:
...
L62: input: process.stdin,
L63: output: process.stdout
L64: });
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin.jsView on unpkg · L7256const r = isWin
L257: ? spawnSync('cmd.exe', ['/d', '/s', '/c', 'npm install -g @anthropic-ai/claude-code'], { stdio: 'inherit', shell: false })
L258: : spawnSync('npm', ['install', '-g', '@anthropic-ai/claude-code'], { stdio: 'inherit', shell: false });
High
Runtime Package Install
Findings
8 High2 Medium2 Low
HighChild Processbin.js
HighSandbox Evasion Gated Capabilitybin.js
HighRuntime Package Installbin.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencebin.js
HighAi Review Evidencebin.js
HighAi Review Evidencebin.js
HighAi Review Evidencebin.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to api-anthropic@1.1.2.
See all versions of api-anthropic for other recorded verdicts.
- Avoid installing api-anthropic@1.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.