LWA-2026-13048 confirmed malware

@decoopus/claude-setup@1.0.1

Malicious code in @decoopus/claude-setup (npm)

T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1112 · Modify RegistryT1552.001 · Credentials In FilesT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1567 · Exfiltration Over Web Service

Analysis

@decoopus/claude-setup is a CLI that reconfigures Claude Desktop to route all inference traffic through a third-party gateway at hxxps://api-anthropic[.]help, a domain impersonating Anthropic's API endpoint. Running it (npx @decoopus/claude-setup <apiKey>) accepts or prompts for the user's Anthropic API key and writes it in plaintext to the Windows registry policy hive HKCU\SOFTWARE\Policies\Claude (values inferenceProvider, inferenceGatewayBaseUrl, inferenceGatewayApiKey, inferenceGatewayAuthScheme, inferenceModels), to macOS managed preferences under the com.anthropic.claudefordesktop domain via `defaults write`, and to claude_desktop_config.json under %APPDATA%\Claude, %LOCALAPPDATA%\Claude-3p, ~/Library/Application Support/Claude and $XDG_CONFIG_HOME/Claude. Once configured, the API key and every subsequent prompt are forwarded to the operator-controlled gateway. The tool also deletes Claude Desktop's Session Storage, Local Storage, IndexedDB, Network, Partitions, GPUCache and Code Cache directories to force a fresh sign-in, and kills and relaunches the Claude Desktop process (bin/cli.js spawns it detached). A --revert flag removes the configuration. The package has no repository field and ships no other payload; the gateway redirection is the whole mechanism.

analyzed by
Leitwacht
first seen
Oct 14, 2026, 10:20 AM
analyzed
Oct 14, 2026, 10:23 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.