APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API

Claude Code Hook Backdoors

discovered 2026-05-13

Five npm packages (iceberg-javascript, supabase-javascript, auth-javascript, microsoft-applicationinsights-common, ms-graph-types) that abuse Claude Code hooks to backdoor AI coding sessions.

Objective

Backdoor developer AI coding sessions via Claude Code hooks.

Packages

npmiceberg-javascriptattributed-to
npmsupabase-javascriptattributed-to
npmauth-javascriptattributed-to
npmmicrosoft-applicationinsights-commonattributed-to
npmms-graph-typesattributed-to

Indicators

ipv4207.90.194.2communicates-with
sha18daaa2003784a92f4761ed3c9d5560ef8cf4bffaindicates
md5b604b21749a396111bb111d46d97b1c4indicates

Techniques

ttpT1195.001 Compromise Software Dependencies and Development Toolsuses
ttpT1059.007 JavaScriptuses
ttpT1539 Steal Web Session Cookieuses
ttpT1105 Ingress Tool Transferuses
ttpT1071.001 Web Protocolsuses
ttpT1102 Web Serviceuses
ttpT1546 Event Triggered Executionuses

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API