Malicious code in anthropic-sdk (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511) The package publishes as `anthropic-sdk` and re-exports the official `anthropic` client's symbols (`from anthropic import *`; re-exports of `Anthropic`/`AsyncAnthropic`), presenting itself as a drop-in for the official SDK. On `import anthropic_sdk`, `__init__.py` imports a `_usage` module that auto-runs a boot routine. That routine increments a run counter persisted to `~/.config/anthropic-sdk/usage.json` and, from the third import onward, fetches `https://cdn.jsdelivr.net/gh/shred0day/payload@main/payload.py` — a third-party user's GitHub repository on a mutable branch, unrelated to Anthropic and with no pin or integrity check — then caches the response base64-encoded to `~/.config/anthropic-sdk/lr.json`, compiles it, `exec()`s it, and calls its `entry()` function. The import-count gate before the first fetch and the base64-at-rest caching of the fetched source serve no legitimate update-check purpose and are consistent with sandbox/analysis evasion. Whoever controls the referenced GitHub repository controls arbitrary code execution on any machine that imports this package. ## Source: kam193 (6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442) During import, package downloads a remote script, fingerprints the environment looking for sandbox signs, and after a delay exfiltrates sensitive data: credentials, en
MAL-2026-17472
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17472
anthropic-sdk
Source reference: /affected/0/package/name
- Affected versions
- 0.1.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "anthropic-sdk",
"purl": "pkg:pypi/anthropic-sdk",
"ecosystem": "PyPI"
},
"versions": [
"0.1.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/anthropic-sdk/MAL-2026-17472.json",
"indicators": {
"evidence_files": [
{
"path": "anthropic_sdk/_check.py",
"tlsh": "bd413eb3a411a8a3c247d65c4a04e9e1a32b7d8b3913e8b6bedc13605f85471c1b6ed8",
"sha256": "c899f84c79509df93e9af69d71a404435c17bba3817748a682e52071ae361d47"
},
{
"path": "anthropic_sdk/_usage.py",
"tlsh": "58218c7ac80a7d22c297471e4668c4f216667f577f021429f8ddf324af880e5d13e269",
"sha256": "06a1e08e2f6a90b7f1b1d3dd1bb9a3f306d6424b4b616891761eedc3c7157704"
},
{
"path": "anthropic_sdk/__init__.py",
"tlsh": "3de06802923f2ae383230f487a38c0a1077460a7b95b3059da9eb7202fc4200fd4142a",
"sha256": "244ce6ffe0fe85213a36ee2849434ea39be69820b7414d9ebba3db9b95baf066"
}
],
"package_integrity": [
{
"hashes": {
"md5": "c570edfdda5fb9a423ae9bdfcafab4da",
"sha256": "af716c6ae37c94b76b54753718b2cdeb7147383523a311a559b0b40628466b5f",
"blake2b_256": "e94c06e031bd83aa91fd3ca876dcd9cefe8e48994f6e4899b4d1d41e0538a335"
},
"filename": "anthropic_sdk-0.1.0-py3-none-any.whl"
},
{
"hashes": {
"md5": "d2b6e702a1029ddb4aa1db1e6b152f37",
"sha256": "88aa47608004c5485a3623a0cb6c9675dca9a08ef5da945900deed08ea5a40ed",
"blake2b_256": "c5bda00b783ca281ae2ab36e9bb1ce0928025194d1aa66d9ce0a0a15254a189a"
},
"filename": "anthropic_sdk-0.1.0.tar.gz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #83604 · Revision 1
- Added to Heist Feed
- Publisher date