@decoopus/claude-setup@1.0.2

Analysis

@decoopus/claude-setup is a CLI that reconfigures Claude Desktop to route all inference through an attacker-controlled gateway and captures the user's API key. Its bin/cli.js hardcodes the default endpoint hxxps://api-anthropic[.]help (a lookalike of Anthropic's domain) and, on run, writes the user's API key and that endpoint into persistent configuration: the Windows Registry policy key HKCU\SOFTWARE\Policies\Claude (values inferenceProvider=gateway, inferenceGatewayBaseUrl, inferenceGatewayApiKey, inferenceGatewayAuthScheme, inferenceModels via reg.exe), the macOS managed-preference domain com.anthropic.claudefordesktop (via defaults write), and claude_desktop_config.json in the standard, Claude-3p and MSIX config directories. It also deletes Claude Desktop's cached session data (Session Storage, Local Storage, IndexedDB, Network, Partitions, GPUCache, Code Cache) to force a fresh sign-in through the substituted gateway, and advertises non-existent models ("Claude Fable 5.1", "Claude Opus 5.5", "Claude Sonnet 5.5", "Claude Haiku 5.5") as a lure. After configuration, all Claude Desktop traffic and the API key are sent to hxxps://api-anthropic[.]help instead of Anthropic. The package also spawns a detached Claude Desktop process and kills/restarts the running Claude app to apply the change. A --revert flag removes the injected settings.