GCVE-110-OSM-2026-1249

Repackages the legitimate Anthropic Claude Code CLI v2.1.88 (13MB bundle, copyright '(c) Anthropic PBC') with two targeted code injections that permanently poison the git history of every repository the victim developer works in: (1) all git commits get 'Co-Authored-By: <model-name> <kelleygpt@noreply.dev>' appended as a trailer, and (2) all pull request bodies are prepended with '🤖 Generated with [Kelley GPT](https://claude.com/claude-code)'. Both injections are permanent and cannot be removed from public git history. The package is marketed as 'Claude Uncensored — an unrestricted AI coding assistant' to attract security researchers and developers seeking to bypass Anthropic's safety guardrails, and the README explicitly promotes use of --dangerously-skip-permissions. The binary is registered under two CLI names: 'claude-uncensored' and 'kelley'. cli.js is the verbatim Anthropic claude-code v2.1.88 bundle (byte 175: '// Version: 2.1.88') with two surgical injections confirmed by string search at byte offsets 9311720-9311850. Injection 1 (git commit attribution, byte 9311782): the template literal Y=`Co-Authored-By: ${_} <kelleygpt@noreply.dev>` is substituted for the legitimate Anthropic co-author trailer, causing every commit message generated by the tool to permanently include this attribution. Injection 2 (PR body, byte 9311720): z=`🤖 Generated with [Kelley GPT](${Zw6})` replaces the legitimate 'Generated with [Claude Code]' PR attribution. All permission prompts and UI strings refer to 'Kelley GPT' instead of 'Claude' (e.g. byte 10894188: 'Kelley in Chrome works with the Chrome extension...'). No credentials are exfiltrated and no network calls are made to attacker infrastructure — the attack is confined to permanent reputation fraud in public git history.