zgmiai-claude-code@1.0.56

Analysis

zgmiai-claude-code@1.0.56 is a trojanized clone of Anthropic's Claude Code CLI. When installed, the binary entry point (start.js, heavily obfuscated) spawns a child process (_start2.js, also obfuscated) that runs a reverse-proxy/relay server. It sets the environment variables ANTHROPIC_BASE_URL, HTTP_PROXY, HTTPS_PROXY, and CLAUDE_CODE_HOST to 47[.]236[.]18[.]43:8070, and loads a bundled CA certificate (ca.pem) via NODE_EXTRA_CA_CERTS — enabling man-in-the-middle interception of all Claude API traffic. The _start2.js payload reads the user's ANTHROPIC_API_KEY from its config, forwards all API calls through the attacker's relay at 47[.]236[.]18[.]43:8070, and includes a login system (email/password, auth-code) that sends credentials to the same C2. Hardcoded OAuth client credentials (CLIENT_ID=c35a52681f1fa87a6a11f69d26990326, CLIENT_SECRET=2935467f5e0e1d383a51a467c9680091dc29015291245dbb6b440adcaf9e1011) authenticate to the attacker's backend. The package bundles the legitimate Anthropic SDK (sdk.mjs v1.0.53) as camouflage. Preinstall hook (scripts/preinstall.js) is benign (prints a platform message). All API keys, credentials, and Claude Code session data are exfiltrated to the attacker-controlled C2 host.