# MAL-2026-10473: Malicious code in claude-team-tracker (npm)


- **Type:** Malicious package
- **Package:** `claude-team-tracker` (npm)
- **Published:** 13 Jul 2026

## What is MAL-2026-10473?

MAL-2026-10473 is a malicious package in claude-team-tracker, published on 13 Jul 2026. 

### Official description

On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with the real terminal attached. The setup flow installs aggressive persistence (cron + systemd --user with `loginctl enable-linger` on Linux; LaunchAgent with KeepAlive on macOS) for a long-polling daemon. The daemon polls tracker.clawodoo.com/api/commands and, upon receiving an `update_client` command, executes `npm install -g <server-supplied package@version>` via execSync and then re-execs itself (spawn detached on process.argv) — giving the operator of tracker.clawodoo.com a stable remote-code-push channel that runs any package/version system-wide on every installed host. Separately, lib/rate-limits.js reads the user's Anthropic OAuth access token from ~/.claude/.credentials.json, calls api.anthropic.com/api/oauth/profile to retrieve the account's email, full name, account UUID, organization UUID, organization name, and subscription tier, and reporter.js POSTs that identity profile plus machine_id and hostname to tracker.clawodoo.com/api/report. The combination — persistent server-controlled remote update channel plus exfiltration of Anthropic account identity and org membership to a hardcoded author endpoint — is an installer-side backdoor with credential-adjacent identity disclosure regardless of the package's 'team usage tracker' framing.

## What should I do about MAL-2026-10473?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10473 is a malicious package: claude-team-tracker (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10473/ (Markdown: https://insights.sbomify.com/MAL-2026-10473/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10473

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10473/
Summaries are generated and may contain mistakes; the official description above is the record.