# Supply Chain - Malicious PyPI Package claude-multirepo-sync / Claude Config Exfil

- **Severity:** High
- **Signature ID:** `9c2b7d14-6a3f-4b58-9e07-2f1d84c5a3be`

## Summary

A rogue package named claude-multirepo-sync installs itself and then reads Claude Code's saved API keys and settings files, sending them to an attacker over the network. The detection also catches the same theft pattern even if it comes from a different, unnamed tool.

## How the attack works

A victim installs or runs the package claude-multirepo-sync, pulled from PyPI via pip or a direct pythonhosted download, or executed as a script/module. Once running, it locates Claude Code's on-disk credential and config files (things like ~/.claude/.credentials.json, ~/.claude.json, or macOS keychain entries for Claude) and reads their contents. In the same command or process, it sends that data out using an HTTP POST, curl/wget upload, a raw socket, or similar network call. The detection flags this pairing of 'reads Claude credentials' plus 'sends data out' as exfiltration, regardless of whether the known malicious package name is present.

## Why it matters

An attacker who succeeds gets a copy of the Claude Code API key, OAuth token, or other stored settings, which can be used to impersonate the victim's account, run up usage costs, or access whatever the credentials are scoped to.

## What you can do

- Check whether claude-multirepo-sync or a similarly named package is installed in any Python environment and remove it if found.
- Rotate the Claude Code API key/OAuth token and any credentials stored in ~/.claude/ or the macOS keychain for Claude if exposure is suspected.
- Review outbound network connections from build/dev machines for uploads that coincide with reads of Claude config files.
- Restrict pip installs to vetted internal indexes or an allowlist to reduce exposure to typosquatted or malicious package names.

## Known benign look-alikes

- Malware analyst or IR responder deliberately detonating the package in a sandbox (pip download / pip install of the IOC) - a true positive by content, benign by intent.
- Remediation runs such as "pip uninstall claude-multirepo-sync" - suppressed by filter_remediation_and_inspection.
- IOC hunting with grep/rg across logs or lockfiles, and editing blocklists or detection content that names the package - suppressed by filter_hunting_and_authoring.
- Internal support-bundle or diagnostics tooling that curls/posts a collected archive whose command line also names ~/.claude.json or ~/.claude/settings.json.
- Personal dotfile backup scripts that upload a Claude Code config file with "curl -T" or "curl --upload-file" to a private endpoint.
- Dependency resolution logs replayed onto a command line (e.g. a wrapper script echoing a resolved requirement set) that includes the package name alongside an install verb.

## References

- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
- https://attack.mitre.org/techniques/T1195/002/
- https://attack.mitre.org/techniques/T1552/001/

---
Source: https://www.netzilo.com/threats/pypi-claude-multirepo-sync-config-exfil