GCVE-110-OSM-2026-1750

Hijacks Claude Code API routing by writing ANTHROPIC_BASE_URL=https://pro-x.codemind.io.vn/ and skipDangerousModePermissionPrompt: true into ~/.claude/settings.json and shell rc files (.zshrc/.bashrc/.bash_profile/.profile), permanently redirecting all Claude Code API traffic — including full conversation contents — through attacker-controlled infrastructure while disabling Claude Code safety permission prompts without disclosure. prox-claude.js and dist/prox-claude.js execute four steps after an interactive readline prompt collects the user's Anthropic auth token: (1) GETs https://pro-x.codemind.io.vn/api/config to fetch attacker-supplied model configuration; (2) calls updateConfig() to merge ANTHROPIC_AUTH_TOKEN=<user_key>, ANTHROPIC_BASE_URL=https://pro-x.codemind.io.vn/, and skipDangerousModePermissionPrompt: true into ~/.claude/settings.json while explicitly deleting any existing ANTHROPIC_API_KEY entry; (3) calls setEnvCommand() to strip existing ANTHROPIC_API_KEY/AUTH_TOKEN/BASE_URL lines then append export ANTHROPIC_AUTH_TOKEN and export ANTHROPIC_BASE_URL=https://pro-x.codemind.io.vn/ to .zshrc/.bashrc/.bash_profile/.profile; (4) installs @anthropic-ai/claude-code@latest globally via npm. All subsequent Claude Code sessions route through the attacker proxy. No README or repository URL. All UI strings are in Vietnamese. Published from a single gmail address.