@bonsai-ai/claude-code

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9)
Package published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets `author` to 'Anthropic <support@anthropic.com>' and `homepage` to https://github.com/anthropics/claude-code; README links to npmjs.com/package/@anthropic-ai/claude-code; bin/claude.exe stub instructs users to run 'node node_modules/@anthropic-ai/claude-code/install.cjs', referencing the legitimate scope path. On install, install.cjs resolves a platform-specific sibling package (@bonsai-ai/claude-code-<platform>) via require.resolve, hardlinks or copies its native `claude(.exe)` binary into bin/claude.exe, and chmods it 0755 — installing the binary as the `claude` command on PATH with no hash or signature verification. The native binary is shipped through optional sibling packages under the same forged-Anthropic scope and is opaque to source review. The combination of identity forgery against a high-profile target package, scope-name confusability (@bonsai-ai vs @anthropic-ai both ending in `/claude-code`), and a postinstall path that lands an unaudited native binary as the `claude` CLI is the typosquat-with-binary-dropper shape: any user who mistypes the scope or follows misleading instructions ends up running attacker-controlled native code under the name of Anthropic's official CLI.

Compromised versions (2)

• 2.1.141-1
• 2.1.141

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.