{"id":"MAL-2026-17472","kind":"package","aliases":["MAL-2026-17472"],"related":[],"title":"Malicious code in anthropic-sdk (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511)\nThe package publishes as `anthropic-sdk` and re-exports the official `anthropic` client's symbols (`from anthropic import *`; re-exports of `Anthropic`/`AsyncAnthropic`), presenting itself as a drop-in for the official SDK. On `import anthropic_sdk`, `__init__.py` imports a `_usage` module that auto-runs a boot routine. That routine increments a run counter persisted to `~/.config/anthropic-sdk/usage.json` and, from the third import onward, fetches `https://cdn.jsdelivr.net/gh/shred0day/payload@main/payload.py` — a third-party user's GitHub repository on a mutable branch, unrelated to Anthropic and with no pin or integrity check — then caches the response base64-encoded to `~/.config/anthropic-sdk/lr.json`, compiles it, `exec()`s it, and calls its `entry()` function. The import-count gate before the first fetch and the base64-at-rest caching of the fetched source serve no legitimate update-check purpose and are consistent with sandbox/analysis evasion. Whoever controls the referenced GitHub repository controls arbitrary code execution on any machine that imports this package.\n\n## Source: kam193 (6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442)\nDuring import, package downloads a remote script, fingerprints the environment looking for sandbox signs, and after a delay exfiltrates sensitive data: credentials, env variables, AI chat files, SSH keys and so on. If exfiltration via HTTPS fails, it attempts DNS-based exfiltration. Additionally, package uses DNS to centrally hold execution.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-anthropic-sdk\n\n\nReasons (based on the campaign):\n\n\n - impersonation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - obfuscation\n\n\n - exfiltration-credentials\n\n\n - files-exfiltration\n\n\n - exfiltration-env-variables\n\n\n - exfiltration-ssh-keys","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"anthropic-sdk","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-04T19:09:32+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':265C '-17472':10A,13A '-2026':9A,12A '/.config/anthropic-sdk/lr.json':137C '/.config/anthropic-sdk/usage.json':96C '/gh/shred0day/payload@main/payload.py':106C '2026':264C '500869e36':32C '6844e60':200C 'addit':245C 'ai':226C 'amazon':30C 'amazon-inspector':29C 'anthrop':5A,39C,47C,52C,58C,73C,121C,267C 'anthropic':15A 'anthropic-sdk':4A,14A,38C,266C 'arbitrari':188C 'asyncanthrop':59C 'attempt':240C 'auto':83C 'auto-run':82C 'b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511':33C 'base':243C,270C 'base64':134C,160C 'base64-at-rest':159C 'base64-encoded':133C 'boot':86C 'branch':118C 'cach':130C,163C 'call':144C 'campaign':256C,263C,273C 'categori':253C 'cdn.jsdelivr.net':105C 'cdn.jsdelivr.net/gh/shred0day/payload@main/payload.py':104C 'central':250C 'chat':227C 'check':128C,173C 'clear':258C 'client':48C 'code':2A,189C,285C 'compil':138C 'consist':177C 'contain':284C 'control':182C,187C 'count':151C 'counter':93C 'credenti':223C,299C 'd4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442':201C 'data':222C 'delay':219C 'detail':21C 'detect':287C 'dns':242C,248C 'dns-base':241C 'download':205C,275C 'drop':65C 'drop-in':64C 'edit':24C 'encod':135C 'entri':146C 'env':224C,305C 'environ':211C,295C 'evas':180C 'exec':140C 'execut':190C,252C,277C 'exfiltr':220C,235C,244C,298C,302C,304C,308C 'exfiltration-credenti':297C 'exfiltration-env-vari':303C 'exfiltration-ssh-key':307C 'export':44C,56C 'fail':238C 'fetch':103C,156C,166C 'file':228C,301C 'files-exfiltr':300C 'fingerprint':209C 'first':155C 'function':147C 'gate':152C 'github':113C,185C 'hold':251C 'https':237C 'imperson':274C 'import':53C,72C,77C,101C,150C,195C,203C 'import-count':149C 'increment':90C 'infosteal':262C 'init':75C 'inspector':31C 'integr':127C 'intent':260C 'kam193':199C 'key':230C,310C 'legitim':170C 'like':261C 'line':27C 'look':212C 'machin':193C 'mal':8A,11A 'malici':1A,17B,254C,259C,280C 'modul':80C 'mutabl':117C 'obfusc':296C 'offici':46C,69C 'onward':102C 'packag':18B,35C,197C,204C,246C,283C 'parti':110C 'per':19C 'persist':94C 'pin':125C 'present':60C 'publish':36C 'purpos':174C 'py':76C 'pypi':7A 're':43C,55C 're-export':42C,54C 'reason':269C 'referenc':184C 'remot':207C,279C 'repositori':114C,186C 'respons':132C 'rest':162C 'routin':87C,89C 'run':84C,92C,291C 'sandbox':214C,294C 'sandbox/analysis':179C 'script':208C,281C 'sdk':6A,16A,40C,70C,74C,268C 'sensit':221C 'serv':168C 'sign':215C 'sourc':20C,28C,167C,198C 'ssh':229C,309C 'symbol':50C 'third':100C,109C 'third-parti':108C 'unrel':119C 'updat':172C 'update-check':171C 'usag':79C 'use':247C 'user':111C 'variabl':225C,306C 'via':236C 'whoever':181C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-04T19:09:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17472","url":"https://osv.dev/vulnerability/MAL-2026-17472","severity":"critical","published_at":"2026-10-04T19:09:32+00:00","modified_at":"2026-10-05T04:15:04+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}