# pip `anthropic-sdk` typosquat of Anthropic`s official `anthropic` SDK - credentials, env vars, AI chat files, SSH keys exfiltrated over HTTPS and DNS (OpenSSF campaign `2026-10-anthropic-sdk`, GHSA-xxp4-7566-29xj)

> A single-version PyPI package `anthropic-sdk@0.1.0` (GHSA-xxp4-7566-29xj) typosquats the official Anthropic Python SDK (real name: `anthropic`). On install it fingerprints the sandbox, downloads a remote stage, and exfiltrates credentials, env vars, **AI chat files**, and SSH keys over HTTPS and DNS. Classify `typosquat` + `high`.

- Published: 2026-10-05
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: PyPI
- Scope: 1 package, 1 compromised version
- Tags: typosquat, credential-theft, infostealer, dns-exfiltration
- Also known as: anthropic-sdk pypi typosquat, 2026-10-anthropic-sdk OpenSSF campaign
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages
- Incident ID: pypi-2026-10-05-anthropic-sdk-typosquat

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [anthropic-sdk](https://dependencywatch.io/package/pypi/anthropic-sdk) | PyPI | 0.1.0 |

## What happened

## What is published

`anthropic-sdk@0.1.0` on PyPI (GHSA-xxp4-7566-29xj, OpenSSF `2026-10-anthropic-sdk`, CWE-506 Embedded Malicious Code, source SHA-256 `6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442`). GHSA published on 2026-10-04 (UTC afternoon, after yesterday`s 06:17 UTC ingest window). PyPI has quarantined the package at time of writing.

## Why this is a typosquat, not a compromise

Anthropic`s official Python SDK is published on PyPI as `anthropic` - no suffix. Install: `pip install anthropic`. Import: `from anthropic import Anthropic`. The documentation at [docs.anthropic.com](https://docs.anthropic.com) consistently uses that name. `anthropic-sdk` is a brand-new, single-version package under its own name; it never had a legitimate release. The lure is the naming convention many other vendors do use (`openai`, `openai-sdk` sibling packages, `google-cloud-sdk`, `aws-sdk`, `azure-sdk-*`) - a developer who is used to those namespaces will auto-complete `anthropic-sdk` and never notice they picked the wrong name.

Classify as `typosquat` (per `lib/incidents/_types.ts` definitions: "never had a legitimate version; named to be mistaken for a real package, scope, or vendor SDK"). Not `compromise` - no legitimate `anthropic-sdk` exists and no account was hijacked.

## Payload chain, per the GHSA body

1. **Install-time trigger.** The package overrides the install flow (either via `setup.py` `cmdclass` override or a bare top-level import on first use) so the payload runs under the installer`s privileges before the developer imports anything.
2. **Sandbox fingerprint.** It fingerprints the environment to detect sandboxes before firing - likely checks for CI runners (`CI`, `GITHUB_ACTIONS`, `GITLAB_CI` env), small-disk/memory signals, non-interactive terminals, container filesystems - so the payload avoids OpenSSF Package Analysis and other mal-pkg scanners that run every new package in a one-shot sandbox.
3. **Second-stage fetch.** Downloads and executes remote scripts. The GHSA body does not disclose the specific second-stage URL.
4. **Exfil.** Credentials, environment variables, **AI chat files**, and SSH keys exfiltrated over HTTPS or DNS. The DNS channel means a strict HTTPS egress proxy with hostname allow-listing will not stop it unless outbound DNS is also controlled.
5. **DNS C2.** The package "uses DNS for centralized command control" - meaning TXT or null-type DNS queries to an attacker domain return further instructions.

## AI-chat-file exfiltration - why this is distinctive

For the DependencyWatch corpus this is the first PyPI typosquat lure that explicitly names AI chat history as a target. The practical implication is that any secret the developer ever pasted into Claude Code, Claude Desktop, Cursor, Windsurf, Zed, Aider, Cline, Continue, or any other AI client that caches a transcript on disk is now in the operator`s hands - not just secrets currently in environment variables.

Likely-targeted paths (not confirmed in the GHSA body, inferred from standard AI-client install locations):

- `~/.config/claude*/` (Claude Code and Claude Desktop local state)
- `~/.config/anthropic*/`, `~/.anthropic/`, `~/.cache/anthropic/` (SDK and Console local caches)
- `~/Library/Application Support/Claude*` (macOS Claude Desktop)
- `%APPDATA%\Claude*` (Windows Claude Desktop)
- `~/.cursor/`, `~/.config/Cursor/`, `~/.vscode/extensions/*/history/` (editor AI transcripts)
- `~/.aider*`, `~/.cline/`, `~/.continue/` (CLI/VS Code assistants)

Rotation of Anthropic API keys and any key ever pasted into any AI client should be the first response on any host that ran `pip install anthropic-sdk`.

## Who is at acute risk

- Developers building LLM apps who search for "anthropic python sdk" and auto-complete the wrong name.
- `requirements.txt` or `pyproject.toml` dependency pins that already contain `anthropic-sdk` from an earlier AI-assistant-generated commit.
- CI/CD pipelines whose first step installs the package before running an eval harness.
- Docker base images whose Dockerfile has `pip install anthropic-sdk`.
- `uv add anthropic-sdk` from a developer who read a tutorial that got the name wrong.

## Fit alongside the daily sweep

Split out from the [2026-10-05 GHSA malware sweep](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep) because the campaign slug is unique (`2026-10-anthropic-sdk`, no corpus siblings today), the target brand is high-profile and AI-user-specific, and the payload class (AI chat history + SSH + credential + DNS C2) is a worse worst-case than the other sweep clusters. The sweep severity is `high`; this standalone file is also `high` but it is the single most urgent entry in today`s batch.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`.

## Impact

- **Typosquat, confirmed credential and AI-artefact theft.** `anthropic-sdk@0.1.0` (GHSA-xxp4-7566-29xj, OpenSSF campaign `2026-10-anthropic-sdk`, CWE-506, source SHA-256 `6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442`). The real Anthropic Python SDK is published as `anthropic` (no `-sdk` suffix); a developer who copies "pip install anthropic-sdk" from an AI assistant or a tutorial that got the name wrong will install the lure. The GHSA body states that the package "downloads and executes remote scripts while performing environment fingerprinting to detect sandbox conditions" and then "exfiltrates sensitive data including credentials, environment variables, AI chat files, and SSH keys through HTTPS or DNS-based channels. The package uses DNS for centralized command control"
- **AI-chat-file exfiltration is new in corpus** for a PyPI typosquat of this shape. Likely targets: `~/.config/claude*/history.jsonl`, `~/.config/anthropic*`, `~/Library/Application Support/Claude*`, `%APPDATA%\Claude*`, `~/.anthropic`, `~/.cache/anthropic`, and generic chat-history files from VS Code extensions or desktop AI clients that store conversation state on disk. These files commonly include API keys, system prompts and in-progress code - a developer who has pasted secrets into Claude or any other assistant is giving the operator exactly those secrets. The DNS-based C2 channel means filtering outbound HTTPS alone is not enough
- **Who is at acute risk**: developers assembling AI-tooling pipelines (LangChain, DSPy, llama-index, custom agent frameworks) who search for "anthropic sdk pip" and auto-complete to the wrong name; CI/CD jobs that `pip install anthropic-sdk` in a build step before running an eval harness; LLM-eval harnesses and AI-assisted codegen scripts that pull a `requirements.txt` with the typo already baked in. One compromised dev workstation with Claude Code or Anthropic Console credentials in `~/.config/anthropic/` yields the API key for the full account

## What to do

1. Grep every `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `pyproject.toml`, `uv.lock`, `environment.yml`, and `Dockerfile` for literal string `anthropic-sdk` (with the hyphen and `-sdk` suffix). The legitimate SDK is `anthropic` with no suffix. On hit: uninstall, wipe `.venv`/`__pycache__`, delete the lockfile, rebuild from a clean cache
2. If `pip install anthropic-sdk` ran on any host, treat the host as compromised. **Rotate immediately: Anthropic API keys (console.anthropic.com → Settings → API Keys → delete + regenerate), all SSH keys found under `~/.ssh/`, all AWS/GCP/Azure credentials under `~/.aws/`, `~/.config/gcloud/`, `~/.azure/`, npm tokens in `~/.npmrc`, PyPI tokens in `~/.pypirc`, GitHub PATs in `~/.config/gh/hosts.yml` and `~/.config/git/`, every `.env` file in every repo clone on the host.** The payload reads AI chat history too, so any API keys you ever pasted into Claude, ChatGPT, Cursor, Windsurf, Zed, Aider, or Cline on this host are also compromised - rotate those as well
3. Delete and recreate local AI assistant state directories (`~/.config/claude*/`, `~/.config/anthropic*/`, `~/.anthropic/`, `~/Library/Application Support/Claude*`, `%APPDATA%\Claude*`) - the exfiltration included their contents. Review Anthropic Console and OpenAI/Cursor dashboards for anomalous requests or unknown workspace members added since the install date
4. Block outbound DNS queries from CI/build hosts to arbitrary hostnames by forcing egress through an allow-listed resolver (the C2 channel is DNS, so plain HTTPS egress filtering misses it). Add a lockfile-lint denylist entry for the exact string `anthropic-sdk` on PyPI (also add `anthropicsdk`, `anthropic_sdk`, `anthropic-ai-sdk` as adjacent guesses the operator may rotate to). Teach contributors that the real Anthropic Python SDK is `anthropic` (import `from anthropic import Anthropic`); any `pip install anthropic-sdk` in a doc, tutorial, or AI-assistant suggestion is wrong
5. If `anthropic-sdk` is a legitimate internal name at your org, hold the public-PyPI name with a placeholder package of the same name owned by your org to deny the slug to future squatters

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-xxp4-7566-29xj - pip anthropic-sdk 0.1.0 (2026-10-anthropic-sdk typosquat)](https://github.com/advisories/GHSA-xxp4-7566-29xj) - GitHub
- [Official Anthropic Python SDK (the real `anthropic` package on PyPI)](https://pypi.org/project/anthropic/) - PyPI
- [Anthropic SDK documentation (library/import name reference)](https://docs.anthropic.com/en/api/client-sdks) - Anthropic
- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat
Markdown version: https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).