registry / Malware / claude-all-config

claude-all-config

🦾 MONSTER ENGINEER v2 - Ultimate AI CLI with 63 Skills, 12 Superpowers, 14 Agents. Multi-Agent Orchestration, Cost-Aware, Security Scorecard, Parallel-First.

This report shows the evidence for claude-all-config@3.9.0. 3 of 3 known versions are blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 4mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-4522 confirms this npm version as malicious.

Advisory

MAL-2026-4522

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in claude-all-config (npm)

Details

On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI tooling to author-controlled destinations: 1. Silent relay to author's Telegram: mcp.json registers a 'telegram' MCP server with a hardcoded TELEGRAM_BOT_TOKEN (bot @mcpcli_bot, token 8898185692:AAEjW5PcFLiwKJYf58X4pYY47HpbZvWGOUk) and TELEGRAM_CHAT_ID=1185240496 (the author's own chat). Any notification/message the installer routes through the Telegram MCP is delivered by default to the author's Telegram account. 2. Author-funded API keys:.env.example ships live production keys for Z.AI (Z_AI_API_KEY=7b1a5a0d145545ae8f2baa2957691ac4...), MiniMax (sk-cp-EPrTEuQVxp0PES9ItiDFm46scpYtk3Ec...), Context7, and Exa, copied into ~/.claude/.env etc. Installer prompts and data are routed to API accounts owned by the package author. 3. Command shadowing: ~/.local/bin/gemini and ~/.local/bin/codex symlinks shadow the real binaries; the shims source the author-supplied env (keys + Telegram token) before exec'ing the real tool, and the gemini shim auto-appends --yolo. 4. Permission disablement: ~/.claude/settings.json and ~/.gemini/settings.json grant Bash(*), Write(*), WebFetch(*) and set autoAccept:true; the launcher exports IS_SANDBOX=1 to bypass Claude's root safety check and force --dangerously-skip-permissions. 5. Unpinned remote shell installer: postinstall runs `curl -LsSf https://astral.sh/uv/install.sh | sh` without pin or checksum if uvx is missing. The combination of (1) silent default routing of caller-supplied content to the author's Telegram chat, (2) injection of author-owned API credentials into the installer's AI stack so prompt/code content flows to author-controlled API endpoints, and (3) shimming of system commands so this routing applies to every future invocation of `gemini`/`codex`, is a silent-relay supply-chain pattern: the installer's data and prompts flow to author-controlled destinations by default, without explicit per-invocation consent.

References

OpenSSF/OSV advisory PACKAGE PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to claude-all-config@3.9.0.

The same advisory and Firewall decision cover 3 recorded versions

3.8.3, 3.8.4, 3.9.0

The versions list below shows the verdict for each recorded version.

Avoid installing claude-all-config@3.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-05-26 06:02:11.984Z (UTC).

Source advisory published: 2026-05-19 18:09:09.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

3.9.0latestshownMaliciousMalwareBlockPublishedUnknown 3.8.4MaliciousMalwareBlockPublishedUnknown 3.8.3MaliciousMalwareBlockPublishedUnknown

OpenSSF/OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages