---
title: GitHub flags 8 npm packages posing as ChatGPT, Claude and Codex setup tools as malware; any machine that installed one should be treated as fully compromised | ctxsec
url: https://ctxsec.com/items/npm-fake-chatgpt-claude-codex-setup-malware
description: ""
status: "confirmed (8 GitHub malware advisories, published Oct 19)"
published: 2026-10-20
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/npm-fake-chatgpt-claude-codex-setup-malware.md)

confirmed (8 GitHub malware advisories, published Oct 19)

2026-10-20

### GitHub flags 8 npm packages posing as ChatGPT, Claude and Codex setup tools as malware; any machine that installed one should be treated as fully compromised

On Oct 19 (21:47 UTC) GitHub published malware advisories for eight npm packages that impersonate setup or activation tools for popular AI assistants: `chatgpt-pro-activator` (GHSA-qp43-mgx6-56x2), `chatgpt-pro-setup-tool` (GHSA-xwx3-5h3q-2v8r), `chatgpt-desktop-setup` (GHSA-pgq5-xq28-533m), `@decoopus/chatgpt-setup` (GHSA-4632-2g34-4r9w), `claude-desktop-setup` (GHSA-f4mf-vhm8-xxqc), `@decoopus/claude-setup` (GHSA-p7p5-jrq5-q47x), `codex-setup` (GHSA-h8cg-xwfv-9x77) and `api-anthropic` (GHSA-cj9w-7h22-q93g). GitHub's standard malware wording applies: any computer with the package installed or running "should be considered fully compromised". Rotate all secrets from a different computer, and know that removing the package may not remove what it installed. The advisories don't describe the payload.

None of these are official. The official SDKs are `openai` and `@anthropic-ai/sdk`, and the desktop apps don't install from npm. The look-alike `api-anthropic` name is the kind a coding agent or a hurried developer could easily type or accept. **Do now:** search lockfiles, CI images, dev containers and agent sandboxes for these eight names (for example `npm ls` or a grep across `package-lock.json`/`pnpm-lock.yaml`). If any turns up, isolate the machine, rotate every key it held, and rebuild. For agents that can run `npm install`, require approval for new dependencies and use an allowlist or registry proxy.

Sources: [GHSA-qp43-mgx6-56x2 (chatgpt-pro-activator)](https://github.com/advisories/GHSA-qp43-mgx6-56x2) · [GHSA-cj9w-7h22-q93g (api-anthropic)](https://github.com/advisories/GHSA-cj9w-7h22-q93g) · [GHSA-h8cg-xwfv-9x77 (codex-setup)](https://github.com/advisories/GHSA-h8cg-xwfv-9x77) · [GHSA-f4mf-vhm8-xxqc (claude-desktop-setup)](https://github.com/advisories/GHSA-f4mf-vhm8-xxqc) · [GitHub Advisory Database: npm malware](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm)