Critical Malicious Code Vulnerability in @decoopus/claude-setup Package
Summary
MAL-2026-18054: Malicious code in @decoopus/claude-setup (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @decoopus/claude-setup package is an npm module designed to facilitate setup processes in various applications. It is commonly used in JavaScript projects to streamline configuration and deployment tasks. However, this package has been identified as containing malicious code, posing significant security risks to any system that has it installed.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the @decoopus/claude-setup package. This code can compromise the entire system, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications of this vulnerability are severe, as it can lead to full control of the affected computer by an external entity. Users are advised to treat any system with this package installed as fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @decoopus/claude-setupIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should ensure that the package is uninstalled and that all sensitive information is secured. There are no alternative methods to mitigate the risk without removing the package.
Conclusion
The @decoopus/claude-setup package has been identified as containing malicious code that poses a significant security risk. Immediate removal of the package and rotation of sensitive information is essential to mitigate the threat. Users are encouraged to utilize tools like Vulert for ongoing monitoring of open-source vulnerabilities.
See every vulnerability recorded for @decoopus/claude-setup →
FAQ
The malicious code is designed to compromise the security of the system, potentially allowing unauthorized access to sensitive information.
If you have the @decoopus/claude-setup package installed, your system is considered compromised. It is recommended to take immediate action.
After removal, rotate all secrets and keys stored on the affected machine from a secure computer to prevent unauthorized access.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities without any signup.
