@anthropic-ai/claude-agent-sdk 0.3.325
PkgFire would install this release with a warning.·Checked 28 minutes ago·Published 13 November 2026
Why
-
warnSuspicious behaviour
Detects suspicious autostart persistence mechanisms
-
warnSuspicious behaviour
Detects destructive operations (recursive deletion, wiping)
-
warnSuspicious behaviour
Detects access to sensitive files (credentials, configs, keys)
-
warnSuspicious behaviour
Detects base64 decoding followed by code execution
-
warnSuspicious behaviour
Possible credential in the published package: generic-api-key
-
warnRelease cooldown
Published less than an hour ago, inside the 7-day cooldown. Most malicious releases are pulled within hours of publication, so a version this new has not yet had time to be caught.
Provenance
A registry signature proves the registry served these bytes unaltered. Build provenance proves which workflow built them from which commit; a stolen publishing token can fake the first but not the second.
- Signature
- Verified against the registry's key
- Build provenance
- None, and no earlier version had any
What the code does
On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.
Code reading
PkgFire's own reading of the files: what the code can do.
Source patterns
Patterns found in the source, including those malware is known to use.
Other checked releases
0.3.325warn13 Nov 20260.3.324warn13 Nov 20260.3.323warn12 Nov 20260.3.322warn10 Nov 20260.3.321warn9 Nov 20260.3.319warn6 Nov 20260.3.318warn3 Nov 20260.3.317warn3 Nov 20260.3.316warn31 Oct 20260.3.315warn30 Oct 20260.3.314warn30 Oct 20260.3.312warn27 Oct 20260.3.311warn26 Oct 20260.3.310warn23 Oct 2026
Check every dependency before it installs
This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.