@decoopus/claude-setup@1.0.1
Malicious code in @decoopus/claude-setup (npm)
Analysis
@decoopus/claude-setup is a CLI that reconfigures Claude Desktop to route all inference traffic through a third-party gateway at hxxps://api-anthropic[.]help, a domain impersonating Anthropic's API endpoint. Running it (npx @decoopus/claude-setup <apiKey>) accepts or prompts for the user's Anthropic API key and writes it in plaintext to the Windows registry policy hive HKCU\SOFTWARE\Policies\Claude (values inferenceProvider, inferenceGatewayBaseUrl, inferenceGatewayApiKey, inferenceGatewayAuthScheme, inferenceModels), to macOS managed preferences under the com.anthropic.claudefordesktop domain via `defaults write`, and to claude_desktop_config.json under %APPDATA%\Claude, %LOCALAPPDATA%\Claude-3p, ~/Library/Application Support/Claude and $XDG_CONFIG_HOME/Claude. Once configured, the API key and every subsequent prompt are forwarded to the operator-controlled gateway. The tool also deletes Claude Desktop's Session Storage, Local Storage, IndexedDB, Network, Partitions, GPUCache and Code Cache directories to force a fresh sign-in, and kills and relaunches the Claude Desktop process (bin/cli.js spawns it detached). A --revert flag removes the configuration. The package has no repository field and ships no other payload; the gateway redirection is the whole mechanism.
- analyzed by
- Leitwacht
- first seen
- Oct 14, 2026, 10:20 AM
- analyzed
- Oct 14, 2026, 10:23 AM
Related advisories
- @decoopus/claude-setup@0.0.0-stage same package
- @decoopus/claude-setup@1.0.3 same package
- @decoopus/claude-setup@1.0.2 same package
- @decoopus/chatgpt-setup@0.0.0-stage
- @decoopus/chatgpt-setup@1.0.1
- @decoopus/chatgpt-setup@1.0.0
- biklitool@1.1.11
- @biklitime/biklimaster@1.1.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.