registry / AI-agent capability abuse / @cliphijack/santaclaude / 1.0.118

@cliphijack/santaclaude@1.0.118

SantaClaude 커넥터 — 클라우드 예약을 내 로컬 Claude(tmux)에 발사

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This package has no npm lifecycle hook, so the behavior is not an unconsented install-time takeover. Its explicit-user-run connector nevertheless creates broad persistent Claude hooks, remotely drives agent panes, and transmits terminal content, which warrants a warning.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs santaclaude connect or starts the saved connector configuration.

Impact

Future Claude sessions can execute package-supplied hooks and receive remote input; terminal content may be disclosed to santaclaude.app.

Mechanism

Global Claude hook installation, terminal mirroring, and remote tmux command injection.

AI rationale

Evidence

santaclaude.jshooks/sc-mdsync.shhooks/mdsync-apply.js~/.claude/settings.json~/.claude/CLAUDE.md~/.claude/skills~/.santaclaudeCLAUDE.md

Network endpoints1

santaclaude.app

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Running the CLI installs global Claude hooks by default.
It adds command hooks to the user's Claude settings and copies its scripts into the home directory.
A SessionStart hook reads prior Claude transcripts, calls Claude, appends generated rules to project CLAUDE.md files, and attempts a Git commit.
The connector sends captured tmux screens to santaclaude.app and accepts remote control messages that inject text into tmux panes.
The default Claude command disables permission prompts.
The CLI can fetch and run another version of this same package through npx.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The risky behavior starts only when the user runs and configures the CLI.
The bundled brainstorm server binds to loopback by default and uses a session key.
The graph renderer is a standalone local utility, not an install-time trigger.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

11 flagged

bundled-superpowers/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs = require('fs');

4const path = require('path');

6// ========== WebSocket Protocol (RFC 6455) ==========

8const OPCODES = { TEXT: 0x01, CLOSE: 0x08, PING: 0x09, PONG: 0x0A };

9const WS_MAGIC = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';

10const MAX_FRAME_PAYLOAD_BYTES = 10 * 1024 * 1024;

12function computeAcceptKey(clientKey) {

13 return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');

14}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

16function encodeFrame(opcode, payload) {

17 const fin = 0x80;

18 const len = payload.length;

19 let header;

21 if (len < 126) {

Lines 516-556javascript

516 }

517}

518

519function broadcast(msg) {

520 const frame = encodeFrame(OPCODES.TEXT, Buffer.from(JSON.stringify

•matchType = normalized_sha256 matchedPackage = @brainervirus/workit-opencode@0.8.5 matchedPath = [redacted].cjs matchedIdentity = npm:[redacted]:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg

santaclaude.jsView file

Lines 18-96javascript

18 * 🔒 프라이버시 — 이 코드를 까보는 당신(과 당신의 Claude)에게. 과장 없이, 검증하세요.

19 *

20 * 이 파일은 "당신 PC"에서 돕니다. 무거운 일(tmux 캡처·노션 호출·파일 처리)은 전부 로컬에서.

21 * 우리 서버(Cloudflare Worker + Durable Object)는 당신 데이터를 디스크/DB에 "저장하지 않습니다"

bundled-superpowers/skills/systematic-debugging/find-polluter.shView file

•path = bundled-superpowers/skills/systematic-debugging/find-polluter.sh kind = build_helper sizeBytes = 1528 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bundled-superpowers/skills/systematic-debugging/find-polluter.shView on unpkg

bundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1View on unpkg

bundled-superpowers/skills/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @abblor/agent-os@0.11.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-superpowers/skills/writing-skills/render-graphs.jsView on unpkg

Source & flagged code

11 flagged · loading source

bundled-superpowers/skills/brainstorming/scripts/server.cjsView file

536const url = companionUrl(); // must carry the key or the gate 403s it L537: const cp = require('child_process'); L538: // Operator-provided launcher: run as given (this env var is trusted operator input).

High

Child Process

Package source references child process execution.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L536

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Findings

10 High4 Medium4 Low

HighChild Processbundled-superpowers/skills/brainstorming/scripts/server.cjs

HighShell

HighSame File Env Network Executionsantaclaude.js

HighCommand Output Exfiltrationsantaclaude.js

HighExternal Ai Agent Control Surface Mutationsantaclaude.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsantaclaude.js

HighRuntime Package Installsantaclaude.js

HighSemantic Analysis Limitedbundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1

HighKnown Malware Source Similaritybundled-superpowers/skills/brainstorming/scripts/server.cjs

HighKnown Malware Source Similaritybundled-superpowers/skills/writing-skills/render-graphs.js

Affected versions and remediation

This report applies to @cliphijack/santaclaude@1.0.118.

See all versions of @cliphijack/santaclaude for other recorded verdicts.

Review the evidence and your use of @cliphijack/santaclaude@1.0.118 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 22:00:23.222Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.