​​Your AI Coding Assistant Just Shipped Your API Keys

Elliot W. Claude's research reveals a significant security concern involving the inadvertent exposure of sensitive credentials through the `.claude/settings.local.json` file in npm packages. This file, which stores approved shell commands, can unintentionally include API keys and other credentials due to its permission model, and it often goes unnoticed during the publishing process. The study monitored 46,500 npm packages and found that 428 contained this file, with 33 of them holding sensitive information like npm authentication tokens, GitHub personal access tokens, and more. The issue arises because the `.claude` directory is not automatically excluded from package contents, unlike common practices for other configuration files. The research emphasizes the importance of adding `.claude/` to `.npmignore` and other exclusion lists to prevent such exposures, and suggests regular checks of package contents before publishing to mitigate the risk. The underlying problem is not unique to npm and can affect other package managers if similar oversight occurs, highlighting a broader need for vigilance in managing what files are included in published packages.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.