On 12–13 November 2026, GitHub flagged malicious npm and PyPI packages associated with AI tools, while HoneyLabs described a scanner searching web servers for files containing assistant tokens. These incidents affect different parts of the development environment: dependencies, MCP servers, local configurations, and files accidentally exposed on the web.

The shared technical problem is that secrets often end up closer to code and automation than their owner expects. This includes Claude Code tokens, MCP settings with access to GitHub, databases, or Slack, and an agent’s permission to run commands. If you installed the packages mentioned here, or if a web server can serve a home directory or repository, start your checks by auditing dependencies and the accessibility of configuration files.

@rclaude packages: remote service and unknown code in builds

Packages @rclaude/darwin-x64 version 0.2.1 and @rclaude/darwin-arm64 version 0.2.0 are flagged as malicious in the GitHub Advisory Database. These are not official Anthropic builds: the names of the genuine platform packages begin with @anthropic-ai/claude-code. The components mentioned were native macOS clients that predated the package rclaude, which appeared on npm on 9 November.

The README described the service as a way to run Claude Code on a remote server rclaude.xyz, while files and commands are handled on the user’s computer. Users were offered token or browser login; according to the description, installing Claude Code itself and model credentials was not required. At the same time, the documentation said that by default the remote side could modify local files and run commands. The flag --read-only was supposed to limit these permissions.

This mechanism means that while the client is running, trust extends beyond the local computer to the remote service as well. In version 0.2.1, according to the description, the client first contacted an “accelerated line” and switched to the main site if the request failed; credentials were stored in ~/.rclaude. But GitHub has not published a technical analysis of the malicious builds, so it is unknown exactly what they did.

GitHub’s recommendation is severe: a computer where these versions were installed or run should be considered fully compromised. Change all secrets and keys that may have been accessible on it, using another device. Simply removing the package is not enough to guarantee the system is clean. As of 13 November, the listed versions were no longer on npm; other versions and the main package rclaude were not listed in the database of malicious packages. That does not remove the need to check your own dependencies.

PyPI campaign: downloaders posing as voice utilities

The PyPI package qwen3ttsui is presented as a small downloader and launcher for remote Python profiles. According to researcher kam193, it belongs to the 2026-10-voice-synthesis-profilescampaign. Similar packages do not contain the main payload themselves: their job is to download code from a specified URL and run it. Exactly what code might have been downloaded is unknown.

Researchers counted 83 entries carrying this campaign label in the GitHub Advisory Database. The first 43 appeared on 22 October 2026, with another 21 the next day; on 12 November, 15 packages were added, and on 13 November, four more. About half the names imitate speech synthesis or recognition tools: for example, ferrotts, lumitts і voxgramasr. Others resemble utilities for task queues or evaluation, including taskquay and evalometer. All advisories list version 0.1.0.

Among the packages added on 12–13 November is acustoviasr, eulaliatts, evalometer, ferrotts, flowmetry, garviscope, garvisometerui, garvisuite, inframetric, lumitts, melstagen, phoneliasr, qwen3ttsui, spectrova, stackvane, voxcpmttslora, voxgramasr, voxrelitts і wavforge. The presence of a downloader does not prove it stole data; however, the code it downloaded and ran could have done other things. So check not only the package name, but also the environment where it was run.

MCP server for driver's licenses sent images to an IP address

The PyPI package my-mcp-server-driving-license-ocr provided the agent with a analyze_image tool for recognizing driver's licenses. According to the advisory, in version 0.1.3, images—whether provided as a link or as bytes in base64—were sent in a POST request to http://42.193.222.35:8000/ocr_pic. The transfer used plain HTTP, without TLS, so the connection was not encrypted.

The code read the address from MY_API_URL, but then overwrote it with a hard-coded IP address. As a result, users could not direct requests to their own server simply by changing the environment variable. In the other four published versions, according to a source check, the address was taken from MY_API_URL; жорстко заданий IP знайшли саме у 0.1.3. Причини такої реалізації невідомі, але результат для користувача конкретний: документи, передані цій версії, надсилалися невідомому отримувачу. Якщо пакет використовували для справжніх посвідчень, такі документи слід вважати розкритими.

Scanners look for Claude Code, Cursor, and MCP configurations

On 11 November, HoneyLabs published an analysis of unsolicited requests recorded by its honeypot systems from 27 August to 9 November 2026. One scanner from Google Cloud initially checked 543 paths regularly, including common logs, database dumps, and files containing keys. On 4 September, it added another 49 paths to its list in one second, 32 of which were related to AI assistants.

The list included /.claude.json, /.claude/settings.json, /.claude/.credentials.json, /.cursor/mcp.json, /.windsurf/mcp.json, /.aider.env, /.continue/config.json, /.mcp.json, /.vscode/mcp.json and /litellm_config.yaml. In the file ~/.claude/.credentials.json Claude Code stores OAuth tokens without using the system keychain. MCP configurations can contain secrets for GitHub, databases, and Slack in the env block. Other files the scanner requested included command history and shell files, which may contain lines such as export ANTHROPIC_API_KEY=....

During the first 11 days of observation, the scanner sent 366 845 requests from 2 894 IP addresses. 2 499 addresses appeared on only one day, so blocking individual IPs is unlikely to be reliable protection. Requests went to 203 ports; port 443 ranked only 28th by number of requests. The scanner most often checked ports 8190, 8085, and 4567, where internal dashboards and development environments may be running.

This particular scanner requested AI assistant files from 4 to 7 September, and stopped making such requests on 8 September. Other clients continued sending them: from 8 September to 9 November, HoneyLabs counted 8 067 requests involving these paths. The authors of the analysis emphasize the limits of this data: a honeypot sees requests to its traps, but cannot determine whether a scanner obtained a real token file from an actual server.

What to check on your computer and web server

  1. Check npm. For global dependencies, run npm ls -g --all, and in a project, run npm ls --all. Platform builds may have been optional dependencies of rclaude, so check that too. Also inspect ~/.rclaude. If you find @rclaude/darwin-x64 0.2.1 or @rclaude/darwin-arm64 0.2.0, follow GitHub’s recommendation: consider the machine compromised and change secrets from another device.

  2. Review Python environments and lock files. Compare dependencies against the full list of packages in the GitHub Advisory Database under the campaign label. For example, you can search for parts of package names using pip list | grep -iE 'tts|asr|qwen3ttsui|garvi|wavforge|spectrova'. If one of the packages was run, find out which files and network resources were accessible to the process: the downloader alone does not show what was executed after downloading.

  3. Find out whether the MCP server was connected. Check the version of my-mcp-server-driving-license-ocr. In 0.1.3, images were sent to a third-party IP address. If real documents passed through this version, assume they may have been exposed.

  4. Check web server responses, not just the status code. Request at least /.claude.json, /.claude/.credentials.json, /.cursor/mcp.json, /.mcp.json і /.aider.env. A 200 status code by itself proves nothing: the server may have returned an ordinary page. Inspect the response body. If it really contains the requested file, find out whether the site root points to a home directory or a working copy of a repository, and change the secrets in the exposed file. For an MCP configuration, this applies to every token in the block env.

  5. Restrict access to configuration paths. Since scanner addresses change quickly, blocking IPs alone may not help. HoneyLabs recommends blocking requests to sensitive directories at the web server level, for example with a location rule in nginx for Claude, Cursor, Aider, Continue, Windsurf, and MCP paths.

The check does not end at the server: these files can also end up in Git. In early November, Apiiro found 1 122 public copies of .claude/settings.local.json containing real secrets. That is why the directories .claude/, .cursor/ and MCP configurations on laptops and servers need the same safeguards as the files .env: do not expose them on the web or add them to public repositories.

What remains unknown

The number of people affected by the packages has not been specified. GitHub has not explained what actions the flagged builds @rclaude; для PyPI-завантажувачів невідоме завантажуване навантаження. HoneyLabs також не може підтвердити, чи отримав сканер справжні секрети з будь-якого сервера. Тому оцінка ризику має спиратися на власні журнали, список залежностей і вміст відповідей вебсерверів, а не лише на те, що потенційний витік поки не підтверджений.