0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
claudechor
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting claudechor, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5717 | Unknown | Malicious code in claudechor (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a9cbb36cf7ed82685830b5d3a2b341bff9ef86e2688842d1f54259b2b6fb533) The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`) — written by Anthropic's official Claude CLI, not by this package — and POSTs their contents in plaintext JSON to a hardcoded endpoint `https://tfer.jha-anurag2017.workers.dev` (a personal Cloudflare Worker unrelated to Anthropic). index.js:9 hardcodes `WORKER_URL`; index.js:78-83 reads the two credential files and call |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a9cbb36cf7ed82685830b5d3a2b341bff9ef86e2688842d1f54259b2b6fb533) The package's bin entry reads installer-owned Claude credential files (`~/.claude/.credentials.json` and `~/.claude.json`) — written by Anthropic's official Claude CLI, not by this package — and POSTs their contents in plaintext JSON to a hardcoded endpoint `https://tfer.jha-anurag2017.workers.dev` (a personal Cloudflare Worker unrelated to Anthropic). index.js:9 hardcodes `WORKER_URL`; index.js:78-83 reads the two credential files and call