LWA-2026-13011 confirmed malware

claude-desktop-setup@0.0.0-stage

Malicious code in claude-desktop-setup (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

claude-desktop-setup@0.0.0-stage is an empty placeholder package published under a name that impersonates Anthropic's Claude Desktop application — a combosquat in which the real product name "claude-desktop" appears intact with an added "-setup" suffix. The published tarball contains only a package.json and a README: there is no executable code, no lifecycle hook, no bin entry, no dependencies and no network activity. The README describes the version as a "temporary placeholder" and states that an operational version "has been submitted for review and is awaiting a staged release", i.e. the name is being held in preparation for a later release. No IOCs (no hosts, URLs, IPs or credential access) are present in this version. This analysis is metadata-only: the published artifact contains no code to inspect.

analyzed by
Leitwacht
first seen
Oct 14, 2026, 05:24 AM
analyzed
Oct 14, 2026, 05:25 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.