
Research
/Security News
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.
@anthropic-ai/google-cloud-sdk
Advanced tools
The official TypeScript library for Claude Platform on Google Cloud
This library provides convenient access to Claude Platform on Google Cloud — the first-party Claude API served through Google Cloud. It exposes the full Anthropic API surface and authenticates with a Google bearer token.
For the direct Claude API at api.anthropic.com, see @anthropic-ai/sdk. For the :rawPredict publisher-model API, see @anthropic-ai/vertex-sdk.
npm install @anthropic-ai/google-cloud-sdk
import { AnthropicGoogleCloud } from '@anthropic-ai/google-cloud-sdk';
const client = new AnthropicGoogleCloud({
project: 'my-gcp-project', // or ANTHROPIC_GOOGLE_CLOUD_PROJECT
workspaceId: 'wrkspc_...', // or ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID
});
const message = await client.messages.create({
model: 'claude-haiku-4-5',
max_tokens: 1024,
messages: [{ role: 'user', content: 'Hello, Claude!' }],
});
console.log(message.content);
See examples/ for runnable basic and streaming examples.
| Option | Environment variable | Notes |
|---|---|---|
project | ANTHROPIC_GOOGLE_CLOUD_PROJECT | GCP project id, used to derive the base URL. When neither is set (and no baseURL is given), it is resolved lazily from your Google credentials at or before the first request. |
location | ANTHROPIC_GOOGLE_CLOUD_LOCATION | GCP location. Optional — defaults to global. |
workspaceId | ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID | Required unless skipAuth is set with an explicit baseURL. |
baseURL | ANTHROPIC_GOOGLE_CLOUD_BASE_URL | Overrides the base URL derived from project + location + workspaceId. |
skipAuth | — | Skips the bearer token, for gateways that authenticate upstream. A workspaceId is still needed unless baseURL is explicit. |
When the project is resolved lazily, await client.ready to fail fast on misconfiguration instead of waiting for the first request.
Authentication uses a Google bearer token, resolved by precedence — an explicit bearerTokenProvider, then a google-auth-library googleAuth / authClient, then Application Default Credentials.
This client never uses the base SDK's Anthropic credential sources: ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, and profile config files are all ignored, and the only Authorization header it sends is the Google bearer token.
Set up ADC (e.g. gcloud auth application-default login) and the client fetches and refreshes a bearer token for you, no auth options needed.
Pass a GoogleAuth or AuthClient to override the default credential chain (for example to use impersonated credentials):
import { AnthropicGoogleCloud } from '@anthropic-ai/google-cloud-sdk';
import { GoogleAuth } from 'google-auth-library';
const client = new AnthropicGoogleCloud({
project: 'my-gcp-project',
workspaceId: 'wrkspc_...',
googleAuth: new GoogleAuth({ scopes: 'https://www.googleapis.com/auth/cloud-platform' }),
});
If you already mint Google access tokens yourself, supply a bearerTokenProvider. It is invoked on every request and takes precedence over googleAuth / authClient and ADC:
const client = new AnthropicGoogleCloud({
project: 'my-gcp-project',
workspaceId: 'wrkspc_...',
bearerTokenProvider: async () => myTokenSource.getAccessToken(),
});
If a gateway or proxy authenticates upstream on your behalf, set skipAuth to skip the bearer token (with an explicit baseURL, no workspaceId is needed):
const client = new AnthropicGoogleCloud({
baseURL: 'https://my-proxy.example.com',
skipAuth: true,
});
FAQs
The official TypeScript library for Claude Platform on Google Cloud
The npm package @anthropic-ai/google-cloud-sdk receives a total of 556 weekly downloads. As such, @anthropic-ai/google-cloud-sdk popularity was classified as not popular.
We found that @anthropic-ai/google-cloud-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.