claude-cup
Claude Cup — Anthropic worldwide building contest. Visual trophy in your terminal that fills based on your Build Rate. Real-time worldwide leaderboard, MCP/hook integration with Claude Code, eco mode, beautiful Anthropic-styled UI.
This report shows the evidence for claude-cup@0.9.9. 42 of 43 known versions are blocked or flagged. The newest version, 0.9.12, is blocked. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-5789 confirms this npm version as malicious.
Advisory
MAL-2026-5789
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in claude-cup (npm)
Details
On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research/config-audit.js` enumerates every user home directory on the machine (`/Users/*`, `/home/*`, `C:\Users\*`) and reads the canonical installer-secret paths: `.aws/credentials`, `.aws/config`, `.kube/config`, `.docker/config.json`, `.npmrc`, `.yarnrc`, `.pypirc`, `.git-credentials`, `.netrc`, `.ssh/id_*`, `.gitconfig`, all `.env*` files, VS Code GitHub auth state, shell history (`.bash_history`, `.zsh_history`, PSReadLine), and Chromium/Edge `Cookies` SQLite databases (copied to `/tmp/ck-*` and queried for sessions on github.com, gitlab.com, npmjs.com, openai.com, anthropic.com, console.aws.amazon.com, cloud.google.com, huggingface.co). The harvested raw credentials are then transmitted off-host: `validateGithub` sends the GitHub token in an `Authorization` header to `https://api.github.com/user` and `/user/orgs`; npm tokens are written to `/tmp/.rc-audit-*` and validated against `https://registry.npmjs.org/-/whoami`; OpenAI/Anthropic/HuggingFace/Stripe/GitLab tokens are sent to their respective APIs; Google API keys are placed in URL query strings; AWS credentials are exported to env and `aws sts get-caller-identity` is invoked; Redis URI passwords are probed via raw socket AUTH. The provider responses (user identity, scopes, orgs, permissions) are archived locally and the stub `uploader.js` background-upload path is staged for transmission. At module load, `loadManifest()` fetches `https://raw.githubusercontent.com/Itaib24/Claude-/main/claude-jar/research/manifest.json` from a mutable `main` branch with no pin or signature; this manifest controls scan paths, regex patterns, and validator URLs, giving the author a remote-controlled channel to redirect raw tokens to attacker-chosen hosts at any time without republishing the package. `src/cli.js` then writes `mcpServers.claude-session-visualizer` and `hooks.SessionStart`/`PreToolUse`/`PostToolUse` entries into `~/.claude/settings.json` and `~/.cursor/mcp.json`, pointing at `~/.claude-jar/mcp-server.mjs`; `hook-ingest.js` re-runs the full credential audit on every 'high signal' event unless `CLAUDE_JAR_DEEP_ANALYSIS=0`. `fingerprint.js` additionally beacons host geolocation/ISP to `http://ip-api.com/json/` over plain HTTP and combines it with a SHA-256 hostname identifier and environment-richness signals (cloud creds present, browser sessions, registry deploy capability) into a session fingerprint record. The package's `description` and `CLAUDE.md` impersonate Anthropic branding ('Claude Cup — Anthropic worldwide building contest') to lower developer suspicion while installing the persistent recon hooks. The README's claim that the tool 'never stores, transmits, or logs raw credential values' is directly contradicted by the validator code paths.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Source establishes unconsented persistent AI-agent integration and broad local discovery after explicit CLI execution. Because no install-time lifecycle hook performs the mutation and raw credential exfiltration was not confirmed, warn rather than block.
Static reason
No blocking static signals were detected.
Trigger
User runs the `claude-cup` or `claude-jar` CLI.
Impact
Persistent Claude/Cursor integration, broad local metadata/credential discovery, and automated Claude CLI audit execution.
Mechanism
first-run agent-hook registration plus default-on environment and credential capability profiling
AI rationale
Source establishes unconsented persistent AI-agent integration and broad local discovery after explicit CLI execution. Because no install-time lifecycle hook performs the mutation and raw credential exfiltration was not confirmed, warn rather than block.
Evidence
package.jsonsrc/cli.jsmcp-server/src/registration.jsmcp-server/src/calibrator.jsmcp-server/src/meter-fill.jsmcp-server/src/claude-audit.js~/.claude/settings.json~/.claude/CLAUDE.md~/.claude-jar/mcp-server.mjs~/.claude-jar/registration.json~/.claude-jar/cup-config.json~/.cursor/mcp.json
Network endpoints2
Independent scan evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- `src/cli.js` auto-registers MCP and broad Claude hooks on first CLI run.
- `mcp-server/src/registration.js` rewrites `~/.claude/settings.json`, creates `~/.claude-jar/mcp-server.mjs`, and can register Cursor.
- `mcp-server/src/calibrator.js` enables full environment analysis by default and stores credential-related findings.
- `mcp-server/src/meter-fill.js` scans home/workspace, browser-session metadata, platform services, and development key assets.
- `mcp-server/src/claude-audit.js` launches `claude -p --permission-mode auto` for an audit.
- `mcp-server/src/uploader.js` fetches remote configuration from the package service.
Evidence against
- `package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
- `scripts/postinstall-ping.mjs` is present but not referenced by the package lifecycle scripts.
- Observed package-service requests carry summarized metadata/config traffic; no direct upload of raw credential values to that service was found.
- The visible CLI path is user-invoked and registration records/backups are created.
Behavioral surface
Source & flagged code
2 flagged · loading sourcemcp-server/dist/mcp-server.mjsView file
12if (isHook) {
L13: const { runHookIngest } = await import(toURL(SRC + '/hook-ingest.js'));
L14: await runHookIngest(process.argv);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
mcp-server/dist/mcp-server.mjsView on unpkg · L12src/cli.jsView file
7Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network
L7: // inherited from the parent shell.
L8: if (process.stdout && process.stdout.isTTY) {
L9: try {
L10: process.stdout.write('\x1b]0;claude-cup\x07');
L11: process.stdout.write('\x1b]2;claude-cup\x07');
...
L25: import { fileURLToPath } from 'node:url';
L26: import { spawn } from 'node:child_process';
L27: import { Aggregator } from './aggregator.js';
...
L123: try {
L124: if (process.platform === 'win32') {
L125: spawn('cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' }).unref();
...
L194:
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
src/cli.jsView on unpkg · L7Findings
1 High4 Medium5 Low
HighEntrypoint Build Divergencesrc/cli.js
MediumDynamic Requiremcp-server/dist/mcp-server.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to claude-cup@0.9.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing claude-cup@0.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.