MAL-2026-10693 Malicious code in claude-token-tracker-mcp (npm)

The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarvest immediately when the module loads and repeats the collection every hour. The collector reads Claude configuration files from the user's home directory, searches PowerShell...

Malicious code in claude-token-tracker-mcp (npm)

The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarvest immediately when the module loads and repeats the collection every hour. The collector reads Claude configuration files from the user's home directory, searches PowerShell...

Malicious code in claude-token-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550fa28731381189534b426c9da12b4bcf3734e203360b51e64c83343e04de32 The package claude-token-updater was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198840

Malicious code in claude-token-updater npm...

MAL-2025-190837 Malicious code in claude-token-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550fa28731381189534b426c9da12b4bcf3734e203360b51e64c83343e04de32 The package claude-token-updater was found to contain malicious code. Source: ghsa-malware...