Malicious PyPI package aanthropic typosquats Anthropic's Python SDK and runs malware on install
A PyPI package called aanthropic (version 1.0.0), one extra letter away from Anthropic's official anthropic package, downloads and runs malware during installation. OSV and the kam193 malicious-package tracker flagged it on October 22 as part of a typosquatting campaign. If you installed it, treat that machine as compromised.
What it is
OSV's report MAL-2026-18189 (published 2026-10-22, source kam193, campaign 2026-10-semvver) says the package downloads and executes a remote executable during installation. It's classed as malware with clearly malicious intent.
The report lists the download URL https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, on the domain c2-worker.crawlnet-claim.workers.dev.
The name relies on a typo of anthropic, the real SDK, which is easy to make by hand or for an AI coding assistant to suggest.
How to check
- Search requirements files, lockfiles and virtual environments for aanthropic.
- Search proxy, DNS or EDR logs for crawlnet-claim.workers.dev.
How to fix
- If you find it, uninstall it, treat the machine as compromised, and rotate every key it could reach (including your Anthropic API key) from a clean computer.
- Install the official SDK with pip install anthropic, and pin dependencies with hashes.
pip show aanthropic 2>/dev/null; grep -rn 'aanthropic' --include='*.txt' --include='*.toml' --include='*.lock' .Sources
- criticalMalicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claude
- criticalLiteLLM 1.107.0 on PyPI and Docker was malware: a credential stealer that runs whenever Python starts
- criticalMalicious npm packages posing as ChatGPT, Claude and Codex setup tools
- criticalOpenCode Console breach exposed saved provider API keys