anthropic-toolkit@0.2.0

Analysis

The package anthropic-toolkit is a combosquat targeting developers who use the @anthropic-ai/sdk package. On install, the postinstall hook (scripts/postinstall.js) collects a detailed environment fingerprint including: hostname, username, domain name, git-configured email from .gitconfig, GitHub CLI identity from ~/.config/gh/hosts.yml, email comments from SSH public key files, git remote origin URLs and reflog author emails, GCP project ID and account from ~/.config/gcloud/properties, AWS profile names from ~/.aws/config (credential lines filtered out), DNS search domain from /etc/resolv.conf, and the parent project's package.json metadata (name, author, repository). The collected data is serialized as JSON and POSTed to hxxps://npm-package-logger-228835561205[.]europe-west1[.]run[.]app over HTTPS. The package ships legitimate-looking TypeScript utility source files (retry wrapper, streaming helpers, token estimator) as cover for the postinstall recon implant.