Unverified85% confidenceFactExact time
恶意包一旦被安装，可在安装脚本或运行时读取环境变量和配置文件，窃取真实API密钥、云凭证、数据库密码等敏感信息
1
Sources
85%
Confidence
Long-term
Relevance
8/2/2026
First Seen
Sources
Claude Package Hallucination Vulnerability: AI Generates Fake Dependency Packages That Steal Real API Keys
Related Entities
Related Claims
Unverified封装安装包常见的恶意植入手段包括键盘记录器、后台挖矿程序和凭证窃取模块（扫描浏览器Cookie、本地密码管理文件和SSH密钥）75% similarUnverified恶意载荷运行后会收集环境变量、SSH 密钥、云凭证、Kubernetes 服务账户令牌及各类供应商 API Key69% similarUnverifiedDirectly executing Skill code downloaded from the internet or autonomously generated by an agent in the host environment poses security risks, as it may contain dangerous operations such as deleting files, accessing sensitive directories, or launching network attacks.69% similarUnverifiedSecurity researchers have repeatedly found that popular IDE cracking tools bundle information-stealing trojans (such as RedLine Stealer and Raccoon Stealer) that can extract browser passwords, cryptocurrency wallet private keys, SSH keys, and developer credentials such as AWS Access Keys and GitHub Tokens.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/679885API
curl https://kongchang.com/api/v1/knowledge/claims/679885MCP
get_claim(id=679885)