AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by Malware in @decoopus/claude-setup? What should I do?

    Malware was found in the npm package @decoopus/claude-setup.

    Affected: npm/@decoopus/claude-setup >= 0. Fixed in: no fix reported yet. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/ghsa-p7p5-jrq5-q47x-npm-decoopus-claude-setup (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: npm/@decoopus/claude-setup >= 0. Fixed in: no fix reported yet.

      • Check your version: run npm ls @decoopus/claude-setup. Versions >= 0 of @decoopus/claude-setup are affected.

      What to do now

      1. Remove the package if it is installed: run npm uninstall @decoopus/claude-setup.
      2. Remove @decoopus/claude-setup from any computer where it is installed.
      3. Rotate all secrets and keys stored on that computer right away, from a different computer.
      4. Do not assume the computer is clean after removing the package, because removing it may not remove all the malicious software.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/ghsa-p7p5-jrq5-q47x-npm-decoopus-claude-setup (opens external site)

      Did this work for you?

    Add your answer or comment