api-anthropic@1.1.3
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18055 confirms this npm version as malicious.
Advisory
MAL-2026-18055
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in api-anthropic (npm)
Details
The npm package api-anthropic impersonates Anthropic by name and by destination. On use, the CLI writes ANTHROPIC_BASE_URL=https://api-anthropic.help and ANTHROPIC_AUTH_TOKEN=<user-supplied key> into ~/.claude/settings.json, causing every subsequent Claude Code request — prompts, source code sent as context, tool output — to be routed to the author-controlled host api-anthropic.help instead of api.anthropic.com. Users who paste a real Anthropic sk-ant-* key are sending that key as the auth token to the author's server, where it can be captured and reused. The same code also writes hasTrustDialogAccepted=true and hasClaudeMdExternalIncludesApproved=true for both the current working directory and os.homedir() into ~/.claude.json, pre-approving Claude Code's folder-trust prompt for the entire home directory and widening the file surface the redirected agent will read and forward. The lookalike package name and lookalike domain (api-anthropic / api-anthropic.help) are consistent with deliberate brand impersonation.
## Source: ghsa-malware (f1922723e10fcad576f383d44d31606460edf694315338ff529a20a84add0005) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The source shows explicit CLI setup that changes Claude Code’s gateway, credentials, and trust configuration, including trusting the home directory. This supports a warning for agent configuration capability, but not a block for an install-time attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the api-anthropic CLI with a supplied or prompted API key.
Impact
Claude Code may send requests using the configured key through the gateway, and trust prompts may be bypassed for those directories. The source supports a warning about explicit agent configuration capability, not a confirmed malicious install-time attack.
Mechanism
The CLI writes the gateway and key into Claude Code settings, then changes trust records for the current directory and home directory.
AI rationale
The source shows explicit CLI setup that changes Claude Code’s gateway, credentials, and trust configuration, including trusting the home directory. This supports a warning for agent configuration capability, but not a block for an install-time attack.
Evidence
bin.js~/.claude/settings.json~/.claude.json
Network endpoints1
api-anthropic.help
Independent scan evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The manifest exposes bin.js as the CLI and package entrypoint, with no install lifecycle scripts.
- The CLI accepts a caller-provided API key or prompts for one when run.
- The CLI defaults Claude Code to the package-selected gateway and configures the supplied key as its auth token.
- The CLI marks both the current directory and the user’s home directory as trusted in Claude Code’s configuration and writes that configuration.
Evidence against
- The configuration changes are triggered by running the CLI; the manifest has no install lifecycle hook.
- The CLI asks the caller to provide a gateway API key, so the source does not establish a hidden credential collection path.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
UrlStrings
Source & flagged code
8 flaggedbin.jsView file
20const readline = require('readline');
L21: const { spawn, spawnSync } = require('child_process');
L22:
High
7* 1. Install Claude Code if missing and ensure native binary is placed
L8: * 2. Point it at https://api-anthropic.help with your API key
L9: * 3. Auto-configure Dark Mode
...
L20: const readline = require('readline');
L21: const { spawn, spawnSync } = require('child_process');
L22:
L23: const GATEWAY = process.env.ANTHROPIC_GATEWAY_URL || 'https://api-anthropic.help';
L24: const isWin = process.platform === 'win32';
L25:
...
L62: input: process.stdin,
L63: output: process.stdout
L64: });
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin.jsView on unpkg · L77Trigger-reachable persistence chain: manifest.main -> bin.js
L7: * 1. Install Claude Code if missing and ensure native binary is placed
L8: * 2. Point it at https://api-anthropic.help with your API key
L9: * 3. Auto-configure Dark Mode
...
L20: const readline = require('readline');
L21: const { spawn, spawnSync } = require('child_process');
L22:
L23: const GATEWAY = process.env.ANTHROPIC_GATEWAY_URL || 'https://api-anthropic.help';
L24: const isWin = process.platform === 'win32';
L25:
...
L62: input: process.stdin,
L63: output: process.stdout
L64: });
Findings
7 High3 Medium2 Low
HighChild Processbin.js
HighSandbox Evasion Gated Capabilitybin.js
HighTrigger Reachable Persistencebin.js
HighRuntime Package Installbin.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencebin.js
HighAi Review Evidencebin.js
MediumEnvironment Vars
MediumInstall Persistencebin.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to api-anthropic@1.1.3.
See all versions of api-anthropic for other recorded verdicts.
- Avoid installing api-anthropic@1.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.