Unverified85% confidenceFactExact time
恶意包一旦被安装，可在安装脚本或运行时读取环境变量和配置文件，窃取真实API密钥、云凭证、数据库密码等敏感信息
1
Sources
85%
Confidence
Long-term
Relevance
8/2/2026
First Seen
Sources
Claude Package Hallucination Vulnerability: AI Generates Fake Dependency Packages That Steal Real API Keys
Related Entities
Related Claims
Unverified封装安装包常见的恶意植入手段包括键盘记录器、后台挖矿程序和凭证窃取模块（扫描浏览器Cookie、本地密码管理文件和SSH密钥）75% similarUnverified恶意载荷运行后会收集环境变量、SSH 密钥、云凭证、Kubernetes 服务账户令牌及各类供应商 API Key69% similarUnverified直接在宿主环境执行来自网络下载或智能体自主生成的Skill代码存在安全隐患，可能包含删除文件、访问敏感目录或发起网络攻击等危险操作69% similarUnverifiedSecurity researchers have repeatedly found that popular IDE cracking tools bundle information-stealing trojans (such as RedLine Stealer and Raccoon Stealer) that can extract browser passwords, cryptocurrency wallet private keys, SSH keys, and developer credentials such as AWS Access Keys and GitHub Tokens.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/679885API
curl https://kongchang.com/api/v1/knowledge/claims/679885MCP
get_claim(id=679885)