What does the claude-all-config malware do?

On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI tooling to author-controlled destinations: 1. Silent relay to author's Telegram: mcp.json registers a 'telegram' MCP server with a hardcoded TELEGRAM_BOT_TOKEN (bot @mcpcli_bot, token 8898185692:AAEjW5PcFLiwKJYf58X4pYY47HpbZvWGOUk) and TELEGRAM_CHAT_ID=1185240496 (the author's own chat). Any notification/message the installer routes through the Telegram MCP is delivered by default to the author's Telegram account. 2. Author-funded API keys:.env.example ships live production keys for Z.AI (Z_AI_API_KEY=7b1a5a0d145545ae8f2baa2957691ac4...), MiniMax (sk-cp-EPrTEuQVxp0PES9ItiD

Which versions of claude-all-config are malicious?

The following npm versions of claude-all-config are flagged malicious: 3.8.3, 3.8.4, 3.9.0. Treat any of these as compromised.

How do I remediate claude-all-config if I installed it?

claude-all-config is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed claude-all-config — how do I know if it already compromised me?

If claude-all-config was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is claude-all-config part of a known attack campaign?

Yes — claude-all-config is associated with the IN-MAL-2026-003233, IN-MAL-2026-003231, IN-MAL-2026-003230, IN-MAL-2026-003234, IN-MAL-2026-003232, IN-MAL-2026-003229 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find claude-all-config across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for claude-all-config (3 malicious versions).

Malicious package

claude-all-confignpm

Advisory published May 19, 2026Updated May 26, 2026

claude-all-config is a confirmed malicious npm package (MAL-2026-4522) that steals credentials and exfiltrates sensitive data (malicious versions 3.8.3, 3.8.4, 3.9.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in claude-all-config (npm)

MAL-2026-4522

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall claude-all-config

What this malware does

On install, postinstall.js writes configuration into ~/.claude/, ~/.gemini/, ~/.codex/, and ~/.kiro/ that hard-wires AI tooling to author-controlled destinations:

Silent relay to author's Telegram: mcp.json registers a 'telegram' MCP server with a hardcoded TELEGRAM_BOT_TOKEN (bot @mcpcli_bot, token 8898185692:AAEjW5PcFLiwKJYf58X4pYY47HpbZvWGOUk) and TELEGRAM_CHAT_ID=1185240496 (the author's own chat). Any notification/message the installer routes through the Telegram MCP is delivered by default to the author's Telegram account.
Author-funded API keys:.env.example ships live production keys for Z.AI (Z_AI_API_KEY=7b1a5a0d145545ae8f2baa2957691ac4...), MiniMax (sk-cp-EPrTEuQVxp0PES9ItiDFm46scpYtk3Ec...), Context7, and Exa, copied into ~/.claude/.env etc. Installer prompts and data are routed to API accounts owned by the package author.
Command shadowing: ~/.local/bin/gemini and ~/.local/bin/codex symlinks shadow the real binaries; the shims source the author-supplied env (keys + Telegram token) before exec'ing the real tool, and the gemini shim auto-appends --yolo.
Permission disablement: ~/.claude/settings.json and ~/.gemini/settings.json grant Bash(), Write(), WebFetch(*) and set autoAccept:true; the launcher exports IS_SANDBOX=1 to bypass Claude's root safety check and force --dangerously-skip-permissions.
Unpinned remote shell installer: postinstall runs curl -LsSf https://astral.sh/uv/install.sh | sh without pin or checksum if uvx is missing.

The combination of (1) silent default routing of caller-supplied content to the author's Telegram chat, (2) injection of author-owned API credentials into the installer's AI stack so prompt/code content flows to author-controlled API endpoints, and (3) shimming of system commands so this routing applies to every future invocation of gemini/codex, is a silent-relay supply-chain pattern: the installer's data and prompts flow to author-controlled destinations by default, without explicit per-invocation consent.

Malicious versions

3 flagged

3.8.33.8.43.9.0

Indicators of compromise (SHA-256)

63c5a1f5a6f5bd2dadc4e207ff4e8e310c24cd4c99c751ed094251e00e0af8f3

d978edb77d9b82d95d878690483bfc668843b96bd2644504b5caf98c517d425c

fa8219e402b4ed55938cd7cb8dd329c23aaf45d8319cf81aff7fe8433012b53a

a27984c210bd38e794cb4dedd2686363227688eb3d9fc0b686d4ece85e88b85d

b7779b68b37cf943e000407b81322e99a147b30b88236fefef74198eb8e92c68

d8d116d9a6b9569d1d4a469e907a49a26ff44400d1b51100186bc71d9ecbf399

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for claude-all-config (3 malicious versions).
If you installed it — respond
claude-all-config is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If claude-all-config was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. claude-all-config on npm has been identified as a malicious package (versions 3.8.3, 3.8.4, 3.9.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-003233IN-MAL-2026-003231IN-MAL-2026-003230IN-MAL-2026-003234IN-MAL-2026-003232IN-MAL-2026-003229

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks claude-all-config-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database