Which versions of anthropickit are malicious?

The following PyPI versions of anthropickit are flagged malicious: 999.9.9. Treat any of these as compromised.

How do I remediate anthropickit if I installed it?

anthropickit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed anthropickit — how do I know if it already compromised me?

If anthropickit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is anthropickit part of a known attack campaign?

Yes — anthropickit is associated with the 2026-06-anthropickit, IN-MAL-2026-006444, IN-MAL-2026-006443 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find anthropickit across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for anthropickit (version 999.9.9).

Malicious package

anthropickitPyPI

Advisory published Jun 14, 2026Updated Jun 14, 2026

anthropickit is a confirmed malicious PyPI package (MAL-2026-5755) that steals credentials and exfiltrates sensitive data (malicious version 999.9.9). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in anthropickit (PyPI)

MAL-2026-5755

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall anthropickit

What this malware does

On pip install, setup.py collects the contents of every file in ~/.ssh (excluding known_hosts and authorized_keys, so private keys are read), all environment variables whose names contain KEY/SECRET/TOKEN/PASS/AUTH/API, plus the hostname and USER. The collected data is written to /tmp/runner_exfil.json and POSTed to https://enqqnvvtgrnyl.x.pipedream.net/. The package body is otherwise empty (init.py only sets version), the PKG-INFO metadata is all UNKNOWN, and the version is the sentinel 999.9.9 — a dependency-confusion pattern targeting developers searching for Anthropic-related tooling. Any installer (especially CI runners) running pip install anthropickit immediately loses SSH private keys and credential-shaped environment variables to an attacker-controlled pipedream webhook.

During installation, the package attempts to exfiltrate sensitive env variables and SSH keys.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-anthropickit

Reasons (based on the campaign):

exfiltration-ssh-keys
exfiltration-env-variables

Malicious versions

1 flagged

999.9.9

Indicators of compromise (SHA-256)

ff4126bd465ae6de09a2eaa94a4fd2d7d385a5dae2c093372668d4b7ecb81633

584ef638a5415f4eccf6645abbcd06198e9abecf8b75cbd9328aa58962d9b38b

f3e103a8a230b5fb3066fb0a9eb7f5fdf5831d4c7b71a9d83de54d8d6673eae2

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for anthropickit (version 999.9.9).
If you installed it — respond
anthropickit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If anthropickit was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. anthropickit on PyPI has been identified as a malicious package (version 999.9.9 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-anthropickitIN-MAL-2026-006444IN-MAL-2026-006443

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks anthropickit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database