{"id":"MAL-2026-4370","summary":"Malicious code in @bonsai-ai/claude-code (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9)\nPackage published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets `author` to 'Anthropic \u003csupport@anthropic.com\u003e' and `homepage` to https://github.com/anthropics/claude-code; README links to npmjs.com/package/@anthropic-ai/claude-code; bin/claude.exe stub instructs users to run 'node node_modules/@anthropic-ai/claude-code/install.cjs', referencing the legitimate scope path. On install, install.cjs resolves a platform-specific sibling package (@bonsai-ai/claude-code-\u003cplatform\u003e) via require.resolve, hardlinks or copies its native `claude(.exe)` binary into bin/claude.exe, and chmods it 0755 — installing the binary as the `claude` command on PATH with no hash or signature verification. The native binary is shipped through optional sibling packages under the same forged-Anthropic scope and is opaque to source review. The combination of identity forgery against a high-profile target package, scope-name confusability (@bonsai-ai vs @anthropic-ai both ending in `/claude-code`), and a postinstall path that lands an unaudited native binary as the `claude` CLI is the typosquat-with-binary-dropper shape: any user who mistypes the scope or follows misleading instructions ends up running attacker-controlled native code under the name of Anthropic's official CLI.\n","modified":"2026-05-27T00:31:53.173572320Z","published":"2026-05-19T18:05:06Z","withdrawn":"2026-05-26T20:55:39Z","database_specific":{"malicious-packages-origins":[{"versions":["2.1.141-1"],"id":"IN-MAL-2026-003228","import_time":"2026-05-26T05:50:15.097065685Z","modified_time":"2026-05-19T18:08:05Z","sha256":"365480cb6843112d60aab619260ad727b156905aa3b30704b30702ab7e52fe49","source":"amazon-inspector"},{"import_time":"2026-05-26T05:50:14.658606521Z","modified_time":"2026-05-19T18:05:06Z","sha256":"45e11d6524e8ecda8e2a909ab1934c93332adf5c121a5b9458da5baa2d601a60","source":"amazon-inspector","versions":["2.1.141"],"id":"IN-MAL-2026-003224"},{"sha256":"ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9","source":"amazon-inspector","versions":["2.1.141"],"id":"IN-MAL-2026-003223","import_time":"2026-05-26T05:50:14.550665923Z","modified_time":"2026-05-19T18:05:06Z"},{"sha256":"dc394b5fb662f6be1c98d310e76341a6877c334fdd8c007a58c7cf75227e8761","source":"amazon-inspector","versions":["2.1.141-1"],"id":"IN-MAL-2026-003227","import_time":"2026-05-26T05:50:15.006466426Z","modified_time":"2026-05-19T18:08:04Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bonsai-ai/claude-code/v/2.1.141"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bonsai-ai/claude-code/v/2.1.141-1"}],"affected":[{"package":{"name":"@bonsai-ai/claude-code","ecosystem":"npm","purl":"pkg:npm/%40bonsai-ai%2Fclaude-code"},"versions":["2.1.141-1","2.1.141"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"claude-code-2.1.141.tgz","hashes":{"sha512_sri":"sha512-/qd62axkNWX3gx8nT/T0J3jH1pL2g4/BBPEr/NWTOYw3lZB6eIrGoRyX+D/coi+QCp0BOCwKFDAiIgV86LwtiQ==","sha1":"2293c9d2200bf3de978ffb9913367b4e478df1bb"}}],"domains":["34.9.16.104.in-addr.arpa"],"evidence_files":[{"tlsh":"5c212704e7655bb35ac4bce09b8b051f62691dd3ca4a3d057763cbc8564f2db982e04a","path":"package.json","sha256":"139ef23455e746675320eb2d097bfa8b3c1d0b99b6a3f05eee1cab0aa75af034"},{"sha256":"d57d8ef49494c9f8723799a348e75f151687f2f88e02199589fd4409c708bba4","tlsh":"56d1838612f966310f5759f6ba8f2062b635c4736229bc0cb8dd83882f9b47481b37e5","path":"install.cjs"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@bonsai-ai/claude-code/MAL-2026-4370.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}