{"slug": "claude-package-scam-how-a-fake-sdk-stole-real-api-keys", "title": "Claude Package Scam: How a Fake SDK Stole Real API Keys", "summary": "A fake Claude package on PyPI, named to closely resemble Anthropic's official SDK, was discovered to be a key stealer that exfiltrated real API keys from developers who installed it. The malicious package was not a typo squat but a deliberate attempt to deceive users into compromising their credentials.", "body_md": "# Claude Package Scam: How a Fake SDK Stole Real API Keys\n\nFake\n\n[Claude](/en/tags/claude/)package on PyPI wasn't a typo squat — it was a tiny little key stealer.The story: someone named a package so close to the official Anthropic SDK that a lot of people probably didn't think twice before installing it. Once it landed, it\n\n[Next My 20-Year Friday Call With Bob Charette: A Mentor's Legacy →](/en/news/4792/)\n\n## All Replies （4）\n\nF\n\nR\n\nAlmost grabbed it last week too. Only caught it because the repo link looked slightly off.\n\n0", "url": "https://wpnews.pro/news/claude-package-scam-how-a-fake-sdk-stole-real-api-keys", "canonical_source": "https://promptcube3.com/en/news/4794/", "published_at": "2026-08-03 02:42:17+00:00", "updated_at": "2026-08-03 02:54:13.828808+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "ai-policy"], "entities": ["Anthropic", "PyPI", "Claude"], "alternates": {"html": "https://wpnews.pro/news/claude-package-scam-how-a-fake-sdk-stole-real-api-keys", "markdown": "https://wpnews.pro/news/claude-package-scam-how-a-fake-sdk-stole-real-api-keys.md", "text": "https://wpnews.pro/news/claude-package-scam-how-a-fake-sdk-stole-real-api-keys.txt", "jsonld": "https://wpnews.pro/news/claude-package-scam-how-a-fake-sdk-stole-real-api-keys.jsonld"}}