VV-140criticalSupply chain2026-10-04

Malicious PyPI package anthropic-sdk posed as Anthropic's Python client

A PyPI package named anthropic-sdk (version 0.1.0) re-exported the real anthropic client so it looked like a drop-in, but from the third import onward it downloaded Python code from a third-party GitHub repo and ran it. Anthropic's official package is anthropic, not anthropic-sdk.

01.

What it is

OSV's report (from Amazon Inspector, published 2026-10-04) says importing anthropic_sdk loads a _usage module that keeps a run counter in ~/.config/anthropic-sdk/usage.json.

From the third import on, it fetches payload.py from the shred0day/payload GitHub repo through jsDelivr, with no pinning or integrity check, caches it base64-encoded in ~/.config/anthropic-sdk/lr.json, then exec()s it and calls entry().

The import-count delay and the encoded cache look designed to dodge sandbox analysis. Whoever controls that repo can run any code on machines that imported the package.

02.

How to check

Search requirements files, lockfiles and environments for anthropic-sdk (not anthropic).
Look for ~/.config/anthropic-sdk/ on developer machines, CI runners and agent sandboxes.

03.

How to fix

If you find it, uninstall it, treat the machine as compromised, and rotate any keys it held (including your Anthropic API key) from a clean computer.
Install the official SDK with pip install anthropic, and pin dependencies with hashes.

pip show anthropic-sdk 2>/dev/null; grep -rn 'anthropic-sdk' --include='*.txt' --include='*.toml' --include='*.lock' . ; ls -la ~/.config/anthropic-sdk 2>/dev/null

04.

Sources

More advisories for this tool