{"answers":{"affected":"1 open source package ship an affected version, including claude-team-tracker.","exploited":"There is no known exploitation of MAL-2026-10473 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10473 is a malicious package in claude-team-tracker, published on 13 Jul 2026."},"fix_prompt":"MAL-2026-10473 is a malicious package: claude-team-tracker (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10473/ (Markdown: https://insights.sbomify.com/MAL-2026-10473/index.md)","id":"MAL-2026-10473","markdown":"https://insights.sbomify.com/MAL-2026-10473/index.md","name":"MAL-2026-10473","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with the real terminal attached. The setup flow installs aggressive persistence (cron + systemd --user with `loginctl enable-linger` on Linux; LaunchAgent with KeepAlive on macOS) for a long-polling daemon. The daemon polls tracker.clawodoo.com/api/commands and, upon receiving an `update_client` command, executes `npm install -g \u003cserver-supplied package@version\u003e` via execSync and then re-execs itself (spawn detached on process.argv) — giving the operator of tracker.clawodoo.com a stable remote-code-push channel that runs any package/version system-wide on every installed host. Separately, lib/rate-limits.js reads the user's Anthropic OAuth access token from ~/.claude/.credentials.json, calls api.anthropic.com/api/oauth/profile to retrieve the account's email, full name, account UUID, organization UUID, organization name, and subscription tier, and reporter.js POSTs that identity profile plus machine_id and hostname to tracker.clawodoo.com/api/report. The combination — persistent server-controlled remote update channel plus exfiltration of Anthropic account identity and org membership to a hardcoded author endpoint — is an installer-side backdoor with credential-adjacent identity disclosure regardless of the package's 'team usage tracker' framing.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in claude-team-tracker (npm)","id":"MAL-2026-10473","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"claude-team-tracker","purl":"pkg:npm/claude-team-tracker","source":"MAL-2026-10473"}],"products":null,"published":"2026-07-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10473/"}