MAL-2026-4370

Dashboard / Malicious Package / MAL-2026-4370

MAL-2026-4370

Summary: Malicious code in @bonsai-ai/claude-code (npm)

Details: Source: amazon-inspector (ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9) Package published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets `author` to 'Anthropic <[email protected]>' and `homepage` to https://github.com/anthropics/claude-code; README links to npmjs.com/package/@anthropic-ai/claude-code; bin/claude.exe stub instructs users to run 'node node_modules/@anthropic-ai/claude-code/install.cjs', referencing the legitimate scope path. On install, install.cjs resolves a platform-specific sibling package (@bonsai-ai/claude-code-<platform>) via require.resolve, hardlinks or copies its native `claude(.exe)` binary into bin/claude.exe, and chmods it 0755 — installing the binary as the `claude` command on PATH with no hash or signature verification. The native binary is shipped through optional sibling packages under the same forged-Anthropic scope and is opaque to source review. The combination of identity forgery against a high-profile target package, scope-name confusability (@bonsai-ai vs @anthropic-ai both ending in `/claude-code`), and a postinstall path that lands an unaudited native binary as the `claude` CLI is the typosquat-with-binary-dropper shape: any user who mistypes the scope or follows misleading instructions ends up running attacker-controlled native code under the name of Anthropic's official CLI.

References: https://www.npmjs.com/package/@bonsai-ai/claude-code/v/2.1.141, https://www.npmjs.com/package/@bonsai-ai/claude-code/v/2.1.141-1