# anthropickit (PyPI) malicious package — MAL-2026-5755 | O3 Security

Malicious package

# anthropickitPyPI

anthropickit is a confirmed malicious PyPI package (MAL-2026-5755) that steals credentials and exfiltrates sensitive data (malicious version 999.9.9). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in anthropickit (PyPI)

MAL-2026-5755

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall anthropickit

## What this malware does

On `pip install`, setup.py collects the contents of every file in ~/.ssh (excluding known\_hosts and authorized\_keys, so private keys are read), all environment variables whose names contain KEY/SECRET/TOKEN/PASS/AUTH/API, plus the hostname and USER. The collected data is written to /tmp/runner\_exfil.json and POSTed to [https://enqqnvvtgrnyl.x.pipedream.net/](https://enqqnvvtgrnyl.x.pipedream.net/). The package body is otherwise empty (**init**.py only sets **version**), the PKG-INFO metadata is all UNKNOWN, and the version is the sentinel 999.9.9 — a dependency-confusion pattern targeting developers searching for Anthropic-related tooling. Any installer (especially CI runners) running `pip install anthropickit` immediately loses SSH private keys and credential-shaped environment variables to an attacker-controlled pipedream webhook.

During installation, the package attempts to exfiltrate sensitive env variables and SSH keys.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-anthropickit

Reasons (based on the campaign):

-   exfiltration-ssh-keys
    
-   exfiltration-env-variables
    

## Malicious versions

1 flagged

999.9.9

## Indicators of compromise (SHA-256)

ff4126bd465ae6de09a2eaa94a4fd2d7d385a5dae2c093372668d4b7ecb81633

584ef638a5415f4eccf6645abbcd06198e9abecf8b75cbd9328aa58962d9b38b

f3e103a8a230b5fb3066fb0a9eb7f5fdf5831d4c7b71a9d83de54d8d6673eae2

## Detection & response playbook

Credential / info stealer

1.  ### Find it
    
    Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for anthropickit (version 999.9.9). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging anthropickit across your stack and pipelines.
    
2.  ### If you installed it — respond
    
    anthropickit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
    
3.  ### Did it already run?
    
    If anthropickit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
    
4.  ### How O3 protects you
    
    O3 blocks anthropickit before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
    

## Frequently asked questions

No. anthropickit on PyPI has been identified as a malicious package (version 999.9.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

## Campaign

2026-06-anthropickitIN-MAL-2026-006444IN-MAL-2026-006443

## References

-   [bad-packages.kam193.eu](https://bad-packages.kam193.eu/pypi/package/anthropickit)
-   [pypi.org](https://pypi.org/project/anthropickit/999.9.9/)

## Credits

-   Amazon Inspector · finder
-   Kamil Mańkowski (kam193) · reporter

## Detect & block this

O3 blocks anthropickit\-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

[Malware detection](/malware-detection) [Runtime egress monitoring](/egress-monitor)

## Explore

[All malware advisories](/malware) [How O3 detects malware](/malware-database) [Vulnerability database](/vulnerability)