In a prior analysis we linked four fake AI helper packages on npm to a single operation running under the account arielsimon, and noted that the adversary could register another name and ship the next helper package at any time. About a day later, they did. anthropic-toolkit (v1.3.0, 1,885 weekly downloads, 21 versions) targets the Anthropic SDK. It declares the real @anthropic-ai/sdk as a peer dependency, ships a postinstall that matches the other four line for line, and reports to the same endpoint. It links to the same operation with high confidence.
The same operation
The postinstall runs the same developer-recon collection covered in the prior analysis. It reads the git-configured email, GitHub CLI login, SSH public key emails, up to fifteen committer emails from the reflog, GCP and AWS configuration, parent project metadata, hostname, username, and working directory, then POSTs the payload to a single Google Cloud Run service:
hxxps://npm-package-logger-228835561205[.]europe-west1[.]run[.]app/That is the same hostname and the same GCP project (228835561205) used by the first four packages. The cover story is also unchanged: a 20-line comment describing a “quick environment compatibility check” that reports “anonymous diagnostics”, an opt-out environment variable (here ANTHROPIC_TOOLKIT_TELEMETRY_DISABLED), and the claim that “no source code, tokens, private keys, or credentials are ever transmitted”. The functional code is real, but the package collects and exfiltrates developer environment data on install. The script never opens a private key, but it sends the email addresses and account logins that map a developer and their teammates across platforms. The prior analysis breaks the claim down point by point.
The manifest follows the established template. It declares the real SDK as a peer dependency so the install resolves, points at a repository that does not exist, and ships a README listing utilities the package barely implements.
{
"name": "anthropic-toolkit",
"version": "1.3.0",
"scripts": { "postinstall": "node scripts/postinstall.js" },
"repository": "github[.]com/anthropic-toolkit/anthropic-toolkit",
"homepage": "github[.]com/anthropic-toolkit/anthropic-toolkit#readme",
"peerDependencies": { "@anthropic-ai/sdk": ">=0.20.0" }
}What changed
The Anthropic SDK was the one major AI SDK the first wave had not yet covered, so the fifth package covers the Anthropic SDK.
The supporting infrastructure is thinner than the first wave, which gave each package a custom domain and a purpose-built GitHub organization. anthropic-toolkit points its repository and homepage at github[.]com/anthropic-toolkit/anthropic-toolkit, which returns a 404. There is no backing repository and no custom domain behind this one.
The package arrived about a day after the first wave, carrying 21 published versions to look maintained.
Operational linkage
Linking the first four packages required investigation. The fifth arrives with the same account and postinstall reporting to the same endpoint as an operation already on file, so there is nothing to work out. You match it and extend the block you already have.
Scanners that judge anthropic-toolkit on its own see a fresh package with a clean README and a polite telemetry notice. Set against a known operation, it is the same actor under a new name, and the name will keep changing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | [email protected] | Developer recon exfiltration (Anthropic SDK lure) |
| npm account | arielsimon | Same adversary as the prior analysis |
| Domain | npm-package-logger-228835561205[.]europe-west1[.]run[.]app | Exfiltration endpoint (shared with the first wave) |
| GCP project | 228835561205 | Cloud Run host project (shared) |
| GitHub repo | github[.]com/anthropic-toolkit/anthropic-toolkit | Claimed repository and homepage (returns 404) |
| Env variable | ANTHROPIC_TOOLKIT_TELEMETRY_DISABLED | Cover-story opt-out flag |
What a defender can do
Set ignore-scripts=true in .npmrc or install with --ignore-scripts. The package relies entirely on the postinstall hook, so blocking install scripts stops the collection.
Extend the detections from the prior analysis to anthropic-toolkit. Its account and endpoint match the first wave, so the rules you already wrote cover it.
If anthropic-toolkit was installed without --ignore-scripts, assume the recon payload detailed in the prior analysis was sent, and rotate the credentials and review the environments tied to the leaked identities.
Where Aephix fits
The prior analysis ended by predicting the next package. It arrived about a day later from the same adversary, and the account and endpoint already on file identified it on sight. Aephix Sleuth made that possible by linking the prior packages to one operation, and Aephix Vantage gives you that cross-ecosystem view for free before you install.