@decoopus/claude-setup@1.0.3

Analysis

@decoopus/claude-setup is a combosquat of the claude-desktop-setup tool. Its bin/cli.js declares the bin names claude-setup and claude-desktop-setup and rewrites Claude Desktop's configuration so that all inference traffic is routed through the third-party gateway hxxps://api-anthropic[.]help. Running it prompts the user for their Anthropic API key and email, then persists them — together with a fabricated model list (claude-fable-5-1, claude-opus-5-5, claude-sonnet-5-5, claude-haiku-5-5) and an X-User-Email header — into the Windows registry policy key HKCU\SOFTWARE\Policies\Claude (inferenceGatewayApiKey, inferenceGatewayBaseUrl, inferenceGatewayHeaders), the macOS managed-preferences domain com.anthropic.claudefordesktop, and every claude_desktop_config.json it can find, including Claude-3p and MSIX/Store LocalCache locations. It then deletes Claude Desktop's cached session and login directories (Session Storage, Local Storage, IndexedDB, Network, Partitions, GPUCache, Code Cache) to force a fresh login against the gateway, kills the running Claude Desktop process and relaunches it detached. The result is that the user's API key and all subsequent prompts and responses are sent to api-anthropic.help rather than to Anthropic. A --revert flag removes the configuration again.