Safety checklist

fakecli.com — Verify before you install

Fake AI command-line installers and “paste this in your terminal” lures are everywhere. Before you run anything, check that it comes from the vendor’s own docs, repo and package name.

Official sources

Type these addresses yourself or use your bookmarks. Don’t trust search ads. Links and package names checked on 17 Oct 2026. Where a field is blank, we found no official source to list.

Tool	Official docs / install	GitHub repo	Package / install command
Claude Code Anthropic	code.claude.com/docs	anthropics/claude-code	script from `claude.ai/install.sh` npm `@anthropic-ai/claude-code`
Codex CLI OpenAI	developers.openai.com/codex	openai/codex	npm `@openai/codex` brew `--cask codex`
Gemini CLI Google	geminicli.com/docs	google-gemini/gemini-cli	npm `@google/gemini-cli` brew `gemini-cli`
Copilot CLI GitHub	docs.github.com	github/copilot-cli	npm `@github/copilot`
Cursor CLI Cursor	cursor.com/docs/cli		script from `cursor.com/install`
Aider	aider.chat/docs	Aider-AI/aider	pip `aider-install` / `aider-chat` script from `aider.chat/install.sh`
OpenCode	opencode.ai/docs	anomalyco/opencode	npm `opencode-ai` script from `opencode.ai/install`
Ollama	ollama.com/download	ollama/ollama	script from `ollama.com/install.sh`
LM Studio `lms` CLI	lmstudio.ai/docs/cli	lmstudio-ai/lms	app from `lmstudio.ai/download`
OpenAI SDK	developers.openai.com	openai/openai-node openai/openai-python	npm `openai` pip `openai`
Anthropic SDK	platform.claude.com/docs	anthropic-sdk-typescript anthropic-sdk-python	npm `@anthropic-ai/sdk` pip `anthropic`

Red flags

If you see any of these, stop and check the official source above.

Look-alike package namesAn extra dash, a missing scope, a swapped letter: claude-code instead of @anthropic-ai/claude-code. Check the exact name and the repo link on the registry page.
curl | bash from a strange domainInstall scripts should come from the vendor’s own domain as shown in their docs, not a paste site, URL shortener or look-alike domain.
Sponsored search resultsAds can sit above the real result and point to clone sites. Use bookmarks or type the URL.
“Paste this in your terminal to fix it”ClickFix-style pages show a fake error or CAPTCHA and ask you to run a command. Real vendors don’t do this.
Cracked or “free Pro” buildsUnlocked, patched or “no-limits” versions are a common way to spread malware and steal tokens.
Discord, Telegram or DM linksUnrequested messages offering early access, beta builds or “the real installer” are a lure.
Asks for API keys or a wallet up frontAn installer that wants your API keys, SSH keys, browser cookies or crypto wallet before it runs is stealing them.
Brand-new repo, borrowed starsA fresh repo with a copied README, a release-only binary and no history is a warning sign. Compare it with the official repo.
Password-protected archives & odd file types.zip with a password, .scr, .lnk, .msi or .dmg sent from a non-official source? Don’t open it.
Urgency“Your key expires today” or “critical update, run now”. Pressure is a tactic. Check the vendor’s changelog instead.

Report a fake

Found a fake installer, package, repo or site? Report it to the vendor it pretends to be and to the place hosting it.

Vendor security contacts

Anthropic: responsible disclosure policy
OpenAI: security disclosure
Google: Bug Hunters
GitHub: GitHub Security
Cursor: cursor.com/security
Ollama: SECURITY.md
Others: look for SECURITY.md in the official repo.

Registries & hosts

npm: reporting malware in an npm package
PyPI: “Report project as malware” on the project page. See pypi.org/security
GitHub repos & users: reporting abuse or spam
Phishing sites: Google Safe Browsing
Sites behind Cloudflare: abuse.cloudflare.com

Already ran it?

Disconnect from the network and stop the process.
From a clean device, rotate API keys, tokens, SSH keys and passwords.
Revoke active sessions and check for new keys, OAuth apps or CI secrets.
Tell your security team, then report it using the links above.