Kaspersky flags claude-mem plugin reading credentials via PowerShell every 30s
nintavur_wings · reddit · 2026-09-13
A Reddit user warns anyone using claude-mem (a Claude Code memory plugin): Kaspersky popped a high-severity Trojan alert (VHO:Trojan.MSIL.Rozena.gen, heuristic) tied to a DLL compiled on the fly by PowerShell.
Investigation revealed claude-mem runs dynamic Cvia PowerShell to invoke the native Win32 CredRead API and polls Claude Code's login token every 30 seconds. Even if it's a heuristic false positive with no malicious intent, the author argues that dynamically shimming credentials in a tight loop is bad practice and uninstalled it immediately. The post includes the AV log, Claude Code's own review, and a second assessment by Gemini.
More from coding & agent
- Anthropic quietly ships server-side rule banning game rewrites in Claude Code — petrusenko_max · 2026-10-31
- Bootstrapping competitive edge with frontier tokens — curious_vii · 2026-10-31
- Element Forge: open-source editable AI VFX for real footage in ComfyUI — zitroffell · 2026-10-30
- Gym-Anything Adds Audit Agents That Try to Break Simulations With Legal Robot Actions — wellecks · 2026-10-30
- durable-object-migrator: zero-downtime exports for Cloudflare Durable Objects — samgoodwin89 · 2026-10-30
- This 5-question interview prompt makes Grok design your first two custom bots in minutes — nateliason · 2026-10-30