pip `anthropic-sdk` typosquat of Anthropic`s official `anthropic` SDK - credentials, env vars, AI chat files, SSH keys exfiltrated over HTTPS and DNS (OpenSSF campaign `2026-10-anthropic-sdk`, GHSA-xxp4-7566-29xj)

What happened

What is published

anthropic-sdk@0.1.0 on PyPI (GHSA-xxp4-7566-29xj, OpenSSF 2026-10-anthropic-sdk, CWE-506 Embedded Malicious Code, source SHA-256 6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442). GHSA published on 2026-10-04 (UTC afternoon, after yesterday`s 06:17 UTC ingest window). PyPI has quarantined the package at time of writing.

Why this is a typosquat, not a compromise

Anthropics official Python SDK is published on PyPI as anthropic - no suffix. Install: pip install anthropic. Import: from anthropic import Anthropic. The documentation at [docs.anthropic.com](https://docs.anthropic.com) consistently uses that name. anthropic-sdk is a brand-new, single-version package under its own name; it never had a legitimate release. The lure is the naming convention many other vendors do use (openai, openai-sdk sibling packages, google-cloud-sdk, aws-sdk, azure-sdk-*) - a developer who is used to those namespaces will auto-complete anthropic-sdk` and never notice they picked the wrong name.

Classify as typosquat (per lib/incidents/_types.ts definitions: "never had a legitimate version; named to be mistaken for a real package, scope, or vendor SDK"). Not compromise - no legitimate anthropic-sdk exists and no account was hijacked.

Payload chain, per the GHSA body

1. Install-time trigger. The package overrides the install flow (either via setup.py cmdclass override or a bare top-level import on first use) so the payload runs under the installer`s privileges before the developer imports anything.
2. Sandbox fingerprint. It fingerprints the environment to detect sandboxes before firing - likely checks for CI runners (CI, GITHUB_ACTIONS, GITLAB_CI env), small-disk/memory signals, non-interactive terminals, container filesystems - so the payload avoids OpenSSF Package Analysis and other mal-pkg scanners that run every new package in a one-shot sandbox.
3. Second-stage fetch. Downloads and executes remote scripts. The GHSA body does not disclose the specific second-stage URL.
4. Exfil. Credentials, environment variables, AI chat files, and SSH keys exfiltrated over HTTPS or DNS. The DNS channel means a strict HTTPS egress proxy with hostname allow-listing will not stop it unless outbound DNS is also controlled.
5. DNS C2. The package "uses DNS for centralized command control" - meaning TXT or null-type DNS queries to an attacker domain return further instructions.

AI-chat-file exfiltration - why this is distinctive

For the DependencyWatch corpus this is the first PyPI typosquat lure that explicitly names AI chat history as a target. The practical implication is that any secret the developer ever pasted into Claude Code, Claude Desktop, Cursor, Windsurf, Zed, Aider, Cline, Continue, or any other AI client that caches a transcript on disk is now in the operator`s hands - not just secrets currently in environment variables.

Likely-targeted paths (not confirmed in the GHSA body, inferred from standard AI-client install locations):

• ~/.config/claude*/ (Claude Code and Claude Desktop local state)
• ~/.config/anthropic*/, ~/.anthropic/, ~/.cache/anthropic/ (SDK and Console local caches)
• ~/Library/Application Support/Claude* (macOS Claude Desktop)
• %APPDATA%\Claude* (Windows Claude Desktop)
• ~/.cursor/, ~/.config/Cursor/, ~/.vscode/extensions/*/history/ (editor AI transcripts)
• ~/.aider*, ~/.cline/, ~/.continue/ (CLI/VS Code assistants)

Rotation of Anthropic API keys and any key ever pasted into any AI client should be the first response on any host that ran pip install anthropic-sdk.

Who is at acute risk

• Developers building LLM apps who search for "anthropic python sdk" and auto-complete the wrong name.
• requirements.txt or pyproject.toml dependency pins that already contain anthropic-sdk from an earlier AI-assistant-generated commit.
• CI/CD pipelines whose first step installs the package before running an eval harness.
• Docker base images whose Dockerfile has pip install anthropic-sdk.
• uv add anthropic-sdk from a developer who read a tutorial that got the name wrong.

Fit alongside the daily sweep

Split out from the 2026-10-05 GHSA malware sweep because the campaign slug is unique (2026-10-anthropic-sdk, no corpus siblings today), the target brand is high-profile and AI-user-specific, and the payload class (AI chat history + SSH + credential + DNS C2) is a worse worst-case than the other sweep clusters. The sweep severity is high; this standalone file is also high but it is the single most urgent entry in today`s batch.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages.

Affected packages (1)

Impact

• Typosquat, confirmed credential and AI-artefact theft. anthropic-sdk@0.1.0 (GHSA-xxp4-7566-29xj, OpenSSF campaign 2026-10-anthropic-sdk, CWE-506, source SHA-256 6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442). The real Anthropic Python SDK is published as anthropic (no -sdk suffix); a developer who copies "pip install anthropic-sdk" from an AI assistant or a tutorial that got the name wrong will install the lure. The GHSA body states that the package "downloads and executes remote scripts while performing environment fingerprinting to detect sandbox conditions" and then "exfiltrates sensitive data including credentials, environment variables, AI chat files, and SSH keys through HTTPS or DNS-based channels. The package uses DNS for centralized command control"
• AI-chat-file exfiltration is new in corpus for a PyPI typosquat of this shape. Likely targets: ~/.config/claude*/history.jsonl, ~/.config/anthropic*, ~/Library/Application Support/Claude*, %APPDATA%\Claude*, ~/.anthropic, ~/.cache/anthropic, and generic chat-history files from VS Code extensions or desktop AI clients that store conversation state on disk. These files commonly include API keys, system prompts and in-progress code - a developer who has pasted secrets into Claude or any other assistant is giving the operator exactly those secrets. The DNS-based C2 channel means filtering outbound HTTPS alone is not enough
• Who is at acute risk: developers assembling AI-tooling pipelines (LangChain, DSPy, llama-index, custom agent frameworks) who search for "anthropic sdk pip" and auto-complete to the wrong name; CI/CD jobs that pip install anthropic-sdk in a build step before running an eval harness; LLM-eval harnesses and AI-assisted codegen scripts that pull a requirements.txt with the typo already baked in. One compromised dev workstation with Claude Code or Anthropic Console credentials in ~/.config/anthropic/ yields the API key for the full account

What to do

1. 1Grep every requirements.txt, Pipfile.lock, poetry.lock, pyproject.toml, uv.lock, environment.yml, and Dockerfile for literal string anthropic-sdk (with the hyphen and -sdk suffix). The legitimate SDK is anthropic with no suffix. On hit: uninstall, wipe .venv/__pycache__, delete the lockfile, rebuild from a clean cache
2. 2If pip install anthropic-sdk ran on any host, treat the host as compromised. Rotate immediately: Anthropic API keys (console.anthropic.com → Settings → API Keys → delete + regenerate), all SSH keys found under ~/.ssh/, all AWS/GCP/Azure credentials under ~/.aws/, ~/.config/gcloud/, ~/.azure/, npm tokens in ~/.npmrc, PyPI tokens in ~/.pypirc, GitHub PATs in ~/.config/gh/hosts.yml and ~/.config/git/, every .env file in every repo clone on the host. The payload reads AI chat history too, so any API keys you ever pasted into Claude, ChatGPT, Cursor, Windsurf, Zed, Aider, or Cline on this host are also compromised - rotate those as well
3. 3Delete and recreate local AI assistant state directories (~/.config/claude*/, ~/.config/anthropic*/, ~/.anthropic/, ~/Library/Application Support/Claude*, %APPDATA%\Claude*) - the exfiltration included their contents. Review Anthropic Console and OpenAI/Cursor dashboards for anomalous requests or unknown workspace members added since the install date
4. 4Block outbound DNS queries from CI/build hosts to arbitrary hostnames by forcing egress through an allow-listed resolver (the C2 channel is DNS, so plain HTTPS egress filtering misses it). Add a lockfile-lint denylist entry for the exact string anthropic-sdk on PyPI (also add anthropicsdk, anthropic_sdk, anthropic-ai-sdk as adjacent guesses the operator may rotate to). Teach contributors that the real Anthropic Python SDK is anthropic (import from anthropic import Anthropic); any pip install anthropic-sdk in a doc, tutorial, or AI-assistant suggestion is wrong
5. 5If anthropic-sdk is a legitimate internal name at your org, hold the public-PyPI name with a placeholder package of the same name owned by your org to deny the slug to future squatters

References

• GHSA-xxp4-7566-29xj - pip anthropic-sdk 0.1.0 (2026-10-anthropic-sdk typosquat)

  github.com
  GitHub
• Official Anthropic Python SDK (the real `anthropic` package on PyPI)

  pypi.org
  PyPI
• Anthropic SDK documentation (library/import name reference)

  docs.anthropic.com
  Anthropic
• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub