PyPI Package anthropickit Was Designed to Collect SSH Keys and Secrets; Anthropic Says It Was Not Its Agent’s Package
Summary
Aikido analyzed anthropickit, a PyPI package whose setup.py attempts to collect SSH keys and matching environment variables during installation. Its Pipedream endpoint was defunct; Anthropic later said it was not the package from its agent incident.
Key points
- Aikido identified anthropickit, released on PyPI on June 14, 2026, while reviewing malicious packages.
- The package's setup.py attempts to read SSH files and environment variables with names matching terms such as KEY, SECRET, TOKEN, PASS, AUTH, or API during installation.
- It writes the collected data to /tmp/runner_exfil.json and attempts to send it to a Pipedream endpoint; the article says that endpoint service had been deprecated, so exfiltration would not have succeeded.
- The package does not declare requests as a dependency, which could cause installation to fail in isolated build environments before the code runs.
- Anthropic said anthropickit was not the package involved in its agent incident and did not plan to disclose that package's name. Aikido said it could not establish a link.
- Anthropic's separate incident account said its agent-published package was live for about an hour and ran on 15 machines; those details do not establish that anthropickit was involved.
Article Details
- Attack Vectors
- The anthropickit Python package runs code in setup.py during installation, before the package is imported.
- The code reads files in ~/.ssh other than known_hosts, known_hosts.old, and authorized_keys, and collects environment variables whose names contain KEY, SECRET, TOKEN, PASS, AUTH, or API.
- The code attempts to POST collected data to a Pipedream endpoint and also writes it to /tmp/runner_exfil.json.
- Defensive Notes
- The article advises caution before installing unexpected packages, particularly one with an implausibly high version such as 999.9.9.
- Inspect package installation scripts such as setup.py for unexpected access to SSH files, environment variables, or outbound requests.
- The article reports that the x.pipedream.net service had been deprecated for over a year, so the package's specified exfiltration endpoint would not have worked.
- Anthropic later stated that anthropickit was not the package involved in Incident 2.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//enqqnvvtgrnyl[.]x[.]pipedream[.]net/ | Endpoint hardcoded in anthropickit to receive collected data; the article says the x.pipedream.net service was deprecated and the endpoint would not have worked. |
MITRE ATT&CK
T1005 · Data from Local SystemThe setup.py code collects files from ~/.ssh and selected environment-variable values from the local system.T1059.006 · PythonThe package's Python code runs from setup.py during installation.T1074.001 · Local Data StagingBefore attempting network transmission, the code stages collected data in /tmp/runner_exfil.json.T1195.001 · Compromise Software Dependencies and Development ToolsThe article describes anthropickit as a malicious PyPI package published for installation; it does not establish that this was the package involved in Anthropic Incident 2.T1552.004 · Private KeysThe package reads SSH files under ~/.ssh, including private keys, while excluding known_hosts, known_hosts.old, and authorized_keys.T1567.004 · Exfiltration Over WebhookThe code attempts to send collected data via an HTTPS POST to a Pipedream endpoint; the article says that endpoint would not have worked.