
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
claude-anyteam
Advanced tools
A Node-powered bootstrap for the Python claude-anyteam tool. The npm package installs uv + the Python tool, then delegates the ~/.claude/settings.json + ~/.claude.json writes to claude-anyteam install so the Python installer is the single source of truth for prereq checks (tmux/psmux required, Codex CLI 0.120+, Gemini CLI, and Kimi CLI warned-if-missing), teammateMode handling, and install-state tracking.
Run exactly this:
npx --yes claude-anyteam
The setup flow shows the banner immediately, checks python3, installs uv if needed, installs or reuses claude-anyteam, runs claude-anyteam install --assume-yes via uv, and registers the Claude Code plugin when claude is on your PATH.
claude-anyteam:
python3uv automatically if it is missingclaude-anyteam with uv tool install, or reuses an existing install if it is already availableuv tool run --from claude-anyteam claude-anyteam install --assume-yes — the Python installer verifies a terminal multiplexer (tmux or psmux) is on PATH, probes for the OpenAI Codex CLI, Gemini CLI, and Kimi CLI (non-blocking warning if missing; Codex also checks the 0.120 floor), writes ~/.claude/settings.json + ~/.claude.json, and records an install-state file for symmetric uninstallclaude-anyteam Claude Code plugin (or reports the exact manual commands if claude is unavailable)If the Python tool is already present in uv's tool bin directory, setup reuses it and re-runs claude-anyteam install (idempotent).
The Python installer owns these files:
~/.claude/settings.json — adds env.CLAUDE_CODE_TEAMMATE_COMMAND + env.CLAUDE_ANYTEAM_BINARY + env.CLAUDE_ANYTEAM_GEMINI_BINARY + env.CLAUDE_ANYTEAM_KIMI_BINARY~/.claude.json — sets teammateMode to "tmux"~/.claude/plugins/data/claude-anyteam-claude-anyteam/install-state.json — receipt so claude-anyteam uninstall reverses everything cleanly.npx --yes claude-anyteam
If the package is installed globally, run either binary — both invoke the same setup flow:
claude-anyteam
# or
claude-anyteam-setup
npm install -g claude-anyteam
claude-anyteam
The npm postinstall hook is best-effort only:
npm install never blocks on a missing prereq — user re-runs npx claude-anyteam to see the full diagnostics)After a successful run, ~/.claude/settings.json contains absolute paths like:
{
"env": {
"CLAUDE_CODE_TEAMMATE_COMMAND": "/Users/you/.local/bin/claude-anyteam-spawn-shim",
"CLAUDE_ANYTEAM_BINARY": "/Users/you/.local/bin/claude-anyteam",
"CLAUDE_ANYTEAM_GEMINI_BINARY": "/Users/you/.local/bin/gemini-anyteam",
"CLAUDE_ANYTEAM_KIMI_BINARY": "/Users/you/.local/bin/kimi-anyteam"
}
}
And ~/.claude.json has teammateMode: "tmux" so Claude Code routes teammates through the pane backend.
Then restart Claude Code.
Provider CLIs are optional at setup time but required when you spawn that prefix:
codex-* → OpenAI Codex CLI 0.120+ (npm install -g @openai/codex, then run codex to sign in)gemini-* → Gemini CLI (npm install -g @google/gemini-cli, then run gemini or configure GEMINI_API_KEY/Vertex)kimi-* → Kimi CLI (pip install kimi-cli or the upstream installer, then run kimi login)Running the installer again is safe: it reuses an existing claude-anyteam tool install, the Python installer is idempotent, and the Claude Code plugin is verified rather than reinstalled when it is already present.
For local development, you can point the installer at a non-PyPI package spec:
CLAUDE_ANYTEAM_PYTHON_PACKAGE=/absolute/path/to/claude-anyteam \
node ./bin/setup.js
FAQs
Beautiful zero-friction installer for claude-anyteam in Claude Code.
The npm package claude-anyteam receives a total of 160 weekly downloads. As such, claude-anyteam popularity was classified as not popular.
We found that claude-anyteam demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.