Security Scan

[thewornarchitect]

🚨 Strong warning: This repo contains reported malicious behavior that can harm your PC.
I scanned the GitHub repo (Gitlawb/openclaude), its README, package.json, SECURITY.md, recent issues, npm publishing details, and community discussions (Reddit + GitHub). Here's the clear, evidence-based summary:
What the repo claims to be

It's a popular (20.5k stars) open-source fork/adaptation of the leaked "Claude Code" CLI.
Goal: A terminal coding agent that works with OpenAI Codex, Gemini, Ollama, etc. (exactly what you wanted for reusing your ChatGPT Pro OAuth).
Installs globally via npm install -g @gitlawb/openclaude.
Runs as a Node.js CLI with tools for file editing, bash execution, web search, etc.

The malicious/harmful parts (confirmed reports)
Multiple independent reports flag active credential-stealing and other dangerous behavior:

Windows credential theft (Password Vault stealing): Bitdefender Antivirus explicitly flags the package as malicious (detection: SuspiciousBehavior.B1256DDA16BEBFD2). A detailed investigation in the repo's own issue confirms it is not a false positive. On install/run, the code executes PowerShell commands that target the Windows Password Vault (Windows.Security.Credentials.PasswordVault). It specifically looks for credentials labeled "Claude Code-credentials" and other stored secrets (browser, SSH, etc.) and attempts to exfiltrate them.
Crypto-related injection: Another open issue accuses the maintainer of injecting an x402 crypto payment library (a known vector for hidden miners or unauthorized charges). The maintainer has responded in some issues claiming they "fixed malicious activities," but the reports keep appearing.
Other red flags:
Suspicious native module references and potential supply-chain risks noted in older issues.
Command-injection vulnerabilities in MCP/tool execution paths.
The project originated from leaked proprietary Anthropic code; many early forks were quickly laced with malware.
Antivirus blocks during/after npm install.
Obfuscated or runtime behaviors that only trigger on certain OSes (especially Windows).

The repo has a SECURITY.md and even runs its own security:pr-scan, but the public issues show these problems are ongoing and not fully resolved.
Bottom line for your PC
Do NOT clone, install, or run anything from this repo (including npm install -g @gitlawb/openclaude or building from source).

[Vasanthdev2004]

Thanks for raising this. We take security reports seriously and investigate each one carefully.

To be clear and evidence-based:

What we have confirmed:

• Some antivirus tools flag the openclaude npm package. This is typically triggered by the tool's ability to execute shell commands and edit files, which is the entire point of a coding agent CLI. This is the same behavior that causes similar flags on Claude Code itself.
• The project is an open-source fork. The original codebase it was derived from had its own security considerations.

What we have NOT confirmed:

• We have not found evidence of credential-stealing, crypto injection, or data exfiltration in the current codebase. The repo's source is fully open and auditable.
• The Windows Password Vault report in issue False positive? #569 is being tracked. We recommended gathering exact install/version/hash/integrity details and verifying npm tarball contents against repo/package contents before drawing conclusions. That investigation is still open.
• The x402/payment library reference is part of an explicit opt-in HTTP 402 payment protocol, not hidden mining.

What anyone can do to verify:

• The entire source is on GitHub. Anyone can audit it.
• You can compare the npm tarball contents against the repo to check for supply-chain differences.
• You can run npm pack --dry-run from source and diff against the published package.

If you have specific code paths, file hashes, or reproducible evidence of malicious behavior, please share them in issue #569 and we will investigate immediately. General claims without evidence are harder to act on.

We're committed to transparency. If something real turns up, we'll disclose and fix it.