claude-desktop-setup@0.0.0-stage
Malicious code in claude-desktop-setup (npm)
Analysis
claude-desktop-setup@0.0.0-stage is an empty placeholder package published under a name that impersonates Anthropic's Claude Desktop application — a combosquat in which the real product name "claude-desktop" appears intact with an added "-setup" suffix. The published tarball contains only a package.json and a README: there is no executable code, no lifecycle hook, no bin entry, no dependencies and no network activity. The README describes the version as a "temporary placeholder" and states that an operational version "has been submitted for review and is awaiting a staged release", i.e. the name is being held in preparation for a later release. No IOCs (no hosts, URLs, IPs or credential access) are present in this version. This analysis is metadata-only: the published artifact contains no code to inspect.
- analyzed by
- Leitwacht
- first seen
- Oct 14, 2026, 05:24 AM
- analyzed
- Oct 14, 2026, 05:25 AM
Related advisories
- css-compat-layer@11.0.9
- @apollolibraryorg/dotenv@1.0.2
- rjs-biginteger@2.0.1
- @ts-expect-error/n@99.9.9
- ticketcathayoct12@0.0.0-stage
- orderly-plugin-liquidity-heatmap@1.0.0
- nodetokyo-us@0.0.0-stage
- liferay-workspace-scripts@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.