Malicious PyPI package anthropic-sdk posed as Anthropic's Python client
A PyPI package named anthropic-sdk (version 0.1.0) re-exported the real anthropic client so it looked like a drop-in, but from the third import onward it downloaded Python code from a third-party GitHub repo and ran it. Anthropic's official package is anthropic, not anthropic-sdk.
What it is
OSV's report (from Amazon Inspector, published 2026-10-04) says importing anthropic_sdk loads a _usage module that keeps a run counter in ~/.config/anthropic-sdk/usage.json.
From the third import on, it fetches payload.py from the shred0day/payload GitHub repo through jsDelivr, with no pinning or integrity check, caches it base64-encoded in ~/.config/anthropic-sdk/lr.json, then exec()s it and calls entry().
The import-count delay and the encoded cache look designed to dodge sandbox analysis. Whoever controls that repo can run any code on machines that imported the package.
How to check
- Search requirements files, lockfiles and environments for anthropic-sdk (not anthropic).
- Look for ~/.config/anthropic-sdk/ on developer machines, CI runners and agent sandboxes.
How to fix
- If you find it, uninstall it, treat the machine as compromised, and rotate any keys it held (including your Anthropic API key) from a clean computer.
- Install the official SDK with pip install anthropic, and pin dependencies with hashes.
pip show anthropic-sdk 2>/dev/null; grep -rn 'anthropic-sdk' --include='*.txt' --include='*.toml' --include='*.lock' . ; ls -la ~/.config/anthropic-sdk 2>/dev/null