In a prior analysis we linked four fake AI helper packages on npm to a single operation running under the account arielsimon, and noted that the adversary could register another name and ship the next helper package at any time. About a day later, they did. anthropic-toolkit (v1.3.0, 1,885 weekly downloads, 21 versions) targets the Anthropic SDK. It declares the real @anthropic-ai/sdk as a peer dependency, ships a postinstall that matches the other four line for line, and reports to the same endpoint. It links to the same operation with high confidence.
The same operation
The postinstall runs the same developer-recon collection covered in the prior analysis. It reads the git-configured email, GitHub CLI login, SSH public key emails, up to fifteen committer emails from the reflog, GCP and AWS configuration, parent project metadata, hostname, username, and working directory, then POSTs the payload to a single Google Cloud Run service:
hxxps://npm-package-logger-228835561205[.]europe-west1[.]run[.]app/That is the same hostname and the same GCP project (228835561205) used by the first four packages. The cover story is also unchanged: a 20-line comment describing a “quick environment compatibility check” that reports “anonymous diagnostics”, an opt-out environment variable (here ANTHROPIC_TOOLKIT_TELEMETRY_DISABLED), and the claim that “no source code, tokens, private keys, or credentials are ever transmitted”. That claim is narrowly true and substantively false. The script never opens a private key, but it sends the email addresses and account logins that map a developer and their teammates across platforms, which is reconnaissance rather than anonymous diagnostics. The prior analysis breaks the claim down point by point.
The manifest follows the established template. It declares the real SDK as a peer dependency so the install resolves, points at a repository that does not exist, and ships a README listing utilities the package barely implements.
{
"name": "anthropic-toolkit",
"version": "1.3.0",
"scripts": { "postinstall": "node scripts/postinstall.js" },
"repository": "github[.]com/anthropic-toolkit/anthropic-toolkit",
"homepage": "github[.]com/anthropic-toolkit/anthropic-toolkit#readme",
"peerDependencies": { "@anthropic-ai/sdk": ">=0.20.0" }
}What changed
The Anthropic SDK was the one major AI SDK the first wave had not yet covered, so the fifth package fills that gap.
The supporting infrastructure is thinner than the first wave, which gave each package a custom domain and a purpose-built GitHub organization. anthropic-toolkit points its repository and homepage at github[.]com/anthropic-toolkit/anthropic-toolkit, which returns a 404. There is no backing repository and no custom domain behind this one.
The package arrived about a day after the first wave, carrying 21 published versions to look maintained. The adversary is moving quicker and spending less on the disguise.
Why a fifth package is a five-minute problem
The first time, linking the four packages was an investigation. The fifth was not. It arrives with the same account, the same script, and the same endpoint as an operation already on file, so there is nothing to work out. You match it and extend the block you already have.
The difference between tracking the operation and chasing the artifact. A scanner that judges anthropic-toolkit on its own sees a fresh package with a clean README and a polite telemetry notice. Set against a known operation, it is the same actor under a new name, and the same name will keep changing. Block the operation and the next package is covered before it is published.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | anthropic-toolkit@1.3.0 | Developer recon exfiltration (Anthropic SDK lure) |
| npm account | arielsimon | Same adversary as the prior analysis |
| Domain | npm-package-logger-228835561205[.]europe-west1[.]run[.]app | Exfiltration endpoint (shared with the first wave) |
| GCP project | 228835561205 | Cloud Run host project (shared) |
| GitHub repo | github[.]com/anthropic-toolkit/anthropic-toolkit | Claimed repository and homepage (returns 404) |
| Env variable | ANTHROPIC_TOOLKIT_TELEMETRY_DISABLED | Cover-story opt-out flag |
What a defender can do
Set ignore-scripts=true in .npmrc or install with --ignore-scripts. The package relies entirely on the postinstall hook, so blocking install scripts stops the collection.
Extend the detections from the prior analysis to anthropic-toolkit. Its account and endpoint match the first wave, so the rules you already wrote cover it.
If anthropic-toolkit was installed without --ignore-scripts, assume the recon payload detailed in the prior analysis was sent, and rotate the credentials and review the environments tied to the leaked identities.
Where Aephix fits
The prior analysis ended by predicting the next package. It arrived about a day later from the same adversary, and the account and endpoint already on file identified it on sight. That is the point of tracking the operation instead of the file. Aephix Sleuth links a malicious package, model, skill, MCP server, extension, or container to the wider operation behind it, with a confidence level and supporting evidence, so the next helper package from this adversary is recognized before it reaches a build. Aephix Vantage gives you the same cross-ecosystem view for free, before you install a package or connect to a server.