AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by Malware found in npm package api-anthropic? What should I do?

    The npm package api-anthropic contains malware.

    Affected: api-anthropic all versions (>= 0). Fixed in: no fix reported yet. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/ghsa-cj9w-7h22-q93g-npm-package-api-anthropic (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: api-anthropic all versions (>= 0). Fixed in: no fix reported yet.

      • Check your version: run npm ls api-anthropic. Versions >= 0 of api-anthropic are affected.

      What to do now

      1. Remove the package if it is installed: run npm uninstall api-anthropic.
      2. Remove the api-anthropic package.
      3. Rotate all secrets and keys stored on the computer, doing so from a different computer.
      4. Do not assume removing the package removes all malicious software, because full control of the computer may have been given to an outside entity.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/ghsa-cj9w-7h22-q93g-npm-package-api-anthropic (opens external site)

      Did this work for you?

    Add your answer or comment