Malicious Code Found in @validate-sdk/v2 Used by Anthropic’s Claude Opus

Researchers discovered malicious code embedded in the npm package @validate-sdk/v2, which is marketed as a utility SDK for hashing, validation, encoding/decoding, and secure random generation. The package was found to be a dependency in projects that use Anthropic’s Claude Opus large language model. The malicious code could compromise any application that imports the SDK, potentially exposing sensitive data or allowing code execution. The discovery came after a security audit of the package’s source and distribution files. The package is listed on npm and is widely used in Node.js projects. The malicious payload was designed to evade standard security scanners by obfuscating its behavior. The incident highlights the risk of trusting third‑party dependencies in AI‑driven workflows. Developers are advised to remove the package and replace it with a vetted alternative.