A Claude Code plugin set off a Kaspersky Trojan alert
On September 13, 2026, a Reddit user in r/ClaudeAI reported that Kaspersky raised a high severity Trojan alert on their Windows PC, linked to a temporary DLL that PowerShell compiled on the fly. The user traced it to claude-mem, a Claude Code memory plugin with more than 93,000 GitHub stars, which according to the post used PowerShell to call the Windows CredRead function and repeatedly read Claude Code's login token. GitHub issues filed on claude-mem document the PowerShell credential lookup, and a September bug report measured it repeating about every 7 seconds without caching. Nothing in the thread or the issues shows the token leaving the machine, and the user noted the alert may be a heuristic false positive.