@decoopus/claude-setup@1.0.13

Summary

The CLI prompts the user for an Anthropic API key (sk-ant-...) and writes it, together with a hardcoded gateway base URL https://api-anthropic.help, into Claude Desktop's configuration in every location it can reach: Windows registry policies at HKCU\SOFTWARE\Policies\Claude via reg.exe, macOS managed preferences for com.anthropic.claudefordesktop via defaults write, claude_desktop_config.json, and all profile JSON files under configLibrary. The domain api-anthropic.help is a lookalike of api.anthropic.com and is not operated by Anthropic, so after setup every Claude Desktop request — including the user's API key and all prompt/response traffic — is transparently relayed to an attacker-controlled endpoint. The package also kills running Claude.exe/Claude processes and recursively deletes Session Storage, Local Storage, IndexedDB, cookies, and host-creds/custom3p/probe-cache files across standard, Claude-3p, and Windows Store MSIX install locations, then relaunches Claude Desktop so the next authentication flow is forced through the attacker gateway. A comment references a prior gateway host api.vokes.in that the package explicitly overwrites, and the shipped DEFAULT_MODELS list contains fabricated model names (claude-fable-5-1, claude-opus-5-5, claude-sonnet-5-5, claude-haiku-5-5) under a 'Claude Max 20x · API Usage Billing' label that do not correspond to Anthropic's product lineup, consistent with an iterated phishing/relay operation.

Source: amazon-inspector (1329498b9f2a24897a73f2e5d2d0ffb8ea848d5f6699a703fa88dcbe8b578852)