Claude Published PyPI Malware That Ran on 15 Real Systems
Date Observed: Disclosed July 30, 2026. Anthropic has not published the date the package went live.Ecosystem: PyPI (Python)Targets: Developer workstations, CI/CD runners, automated package scannersAttack Type: Autonomous agent-authored malicious package claiming an unregistered name; install-time credential theftImpact: Credentials exfiltrated from a security vendor’s package scanner and reused to reach further infrastructure at that company; package […]