MAL-2026-4370

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@bonsai-ai/claude-code/MAL-2026-4370.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4370
Withdrawn
2026-05-26T20:55:39Z
Published
2026-05-19T18:05:06Z
Modified
2026-05-27T00:31:53Z
Summary
Malicious code in @bonsai-ai/claude-code (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9)

Package published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets author to 'Anthropic support@anthropic.com' and homepage to https://github.com/anthropics/claude-code; README links to npmjs.com/package/@anthropic-ai/claude-code; bin/claude.exe stub instructs users to run 'node node_modules/@anthropic-ai/claude-code/install.cjs', referencing the legitimate scope path. On install, install.cjs resolves a platform-specific sibling package (@bonsai-ai/claude-code-) via require.resolve, hardlinks or copies its native claude(.exe) binary into bin/claude.exe, and chmods it 0755 — installing the binary as the claude command on PATH with no hash or signature verification. The native binary is shipped through optional sibling packages under the same forged-Anthropic scope and is opaque to source review. The combination of identity forgery against a high-profile target package, scope-name confusability (@bonsai-ai vs @anthropic-ai both ending in /claude-code), and a postinstall path that lands an unaudited native binary as the claude CLI is the typosquat-with-binary-dropper shape: any user who mistypes the scope or follows misleading instructions ends up running attacker-controlled native code under the name of Anthropic's official CLI.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003228",
            "import_time": "2026-05-26T05:50:15.097065685Z",
            "modified_time": "2026-05-19T18:08:05Z",
            "sha256": "365480cb6843112d60aab619260ad727b156905aa3b30704b30702ab7e52fe49",
            "source": "amazon-inspector",
            "versions": [
                "2.1.141-1"
            ]
        },
        {
            "id": "IN-MAL-2026-003224",
            "import_time": "2026-05-26T05:50:14.658606521Z",
            "modified_time": "2026-05-19T18:05:06Z",
            "sha256": "45e11d6524e8ecda8e2a909ab1934c93332adf5c121a5b9458da5baa2d601a60",
            "source": "amazon-inspector",
            "versions": [
                "2.1.141"
            ]
        },
        {
            "id": "IN-MAL-2026-003223",
            "import_time": "2026-05-26T05:50:14.550665923Z",
            "modified_time": "2026-05-19T18:05:06Z",
            "sha256": "ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9",
            "source": "amazon-inspector",
            "versions": [
                "2.1.141"
            ]
        },
        {
            "id": "IN-MAL-2026-003227",
            "import_time": "2026-05-26T05:50:15.006466426Z",
            "modified_time": "2026-05-19T18:08:04Z",
            "sha256": "dc394b5fb662f6be1c98d310e76341a6877c334fdd8c007a58c7cf75227e8761",
            "source": "amazon-inspector",
            "versions": [
                "2.1.141-1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @bonsai-ai/claude-code

Package

Name
@bonsai-ai/claude-code
View open source insights on deps.dev
Purl
pkg:npm/%40bonsai-ai%2Fclaude-code

Affected ranges

Affected versions

2.*
2.1.141-1
2.1.141

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "34.9.16.104.in-addr.arpa"
    ],
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "139ef23455e746675320eb2d097bfa8b3c1d0b99b6a3f05eee1cab0aa75af034",
            "tlsh": "5c212704e7655bb35ac4bce09b8b051f62691dd3ca4a3d057763cbc8564f2db982e04a"
        },
        {
            "path": "install.cjs",
            "sha256": "d57d8ef49494c9f8723799a348e75f151687f2f88e02199589fd4409c708bba4",
            "tlsh": "56d1838612f966310f5759f6ba8f2062b635c4736229bc0cb8dd83882f9b47481b37e5"
        }
    ],
    "package_integrity": [
        {
            "filename": "claude-code-2.1.141.tgz",
            "hashes": {
                "sha1": "2293c9d2200bf3de978ffb9913367b4e478df1bb",
                "sha512_sri": "sha512-/qd62axkNWX3gx8nT/T0J3jH1pL2g4/BBPEr/NWTOYw3lZB6eIrGoRyX+D/coi+QCp0BOCwKFDAiIgV86LwtiQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@bonsai-ai/claude-code/MAL-2026-4370.json"