anthropickit

{"modified":"2026-06-14T07:45:13Z","published":"2026-06-14T01:37:46Z","schema_version":"1.7.4","id":"MAL-2026-5755","summary":"Malicious code in anthropickit (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f3e103a8a230b5fb3066fb0a9eb7f5fdf5831d4c7b71a9d83de54d8d6673eae2)\nOn `pip install`, setup.py collects the contents of every file in ~/.ssh (excluding known_hosts and authorized_keys, so private keys are read), all environment variables whose names contain KEY/SECRET/TOKEN/PASS/AUTH/API, plus the hostname and USER. The collected data is written to /tmp/runner_exfil.json and POSTed to https://enqqnvvtgrnyl.x.pipedream.net/. The package body is otherwise empty (__init__.py only sets __version__), the PKG-INFO metadata is all UNKNOWN, and the version is the sentinel 999.9.9 — a dependency-confusion pattern targeting developers searching for Anthropic-related tooling. Any installer (especially CI runners) running `pip install anthropickit` immediately loses SSH private keys and credential-shaped environment variables to an attacker-controlled pipedream webhook.\n\n## Source: kam193 (ff4126bd465ae6de09a2eaa94a4fd2d7d385a5dae2c093372668d4b7ecb81633)\nDuring installation, the package attempts to exfiltrate sensitive env variables and SSH keys.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-anthropickit\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-ssh-keys\n\n\n - exfiltration-env-variables\n","affected":[{"package":{"ecosystem":"PyPI","name":"anthropickit"},"versions":["999.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"7361a8e38c72a2992890ae755b5df4a304dff5a31368abdf5cd4b354d8b5e56e","tlsh":"6b11564de46b2431d777bb4c1c1c8d323b9efd3a17a6b8b5b8ccaf1047496362558218"},{"path":"PKG-INFO","sha256":"e7bde94252c51c1ee62011071106d31ae2a3a3be4afcb55e944a858f1e06df18","tlsh":"e9c02b4854334133d2d71589246c43d01dd34608244d3cfd404036004b106511f700f3"}],"ips":["104.16.1.34"],"package_integrity":[{"filename":"anthropickit-999.9.9.tar.gz","hashes":{"blake2b_256":"4d90ebb6cc11a278e781638995201fb18f530912490fff547478ba75b68ff8ba","md5":"7df12487bade710459ccea2d3570cdbc","sha256":"4ae13303fa1663a36cfaa70bebe77b52b12dbf17eef24db15c6c24c631d38fbf"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/anthropickit"},{"type":"PACKAGE","url":"https://pypi.org/project/anthropickit/999.9.9/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"malicious-packages-origins":[{"source":"kam193","sha256":"ff4126bd465ae6de09a2eaa94a4fd2d7d385a5dae2c093372668d4b7ecb81633","import_time":"2026-06-14T02:22:45.870360622Z","id":"pypi/2026-06-anthropickit/anthropickit","modified_time":"2026-06-14T01:37:47.165599Z","versions":["999.9.9"]},{"source":"amazon-inspector","sha256":"584ef638a5415f4eccf6645abbcd06198e9abecf8b75cbd9328aa58962d9b38b","import_time":"2026-06-14T07:43:27.142879663Z","id":"IN-MAL-2026-006444","modified_time":"2026-06-14T07:05:12Z","versions":["999.9.9"]},{"source":"amazon-inspector","sha256":"f3e103a8a230b5fb3066fb0a9eb7f5fdf5831d4c7b71a9d83de54d8d6673eae2","import_time":"2026-06-14T07:43:27.08033219Z","id":"IN-MAL-2026-006443","modified_time":"2026-06-14T07:05:11Z","versions":["999.9.9"]}]}}