registry / AI-agent capability abuse / @cliphijack/santaclaude / 1.0.119

@cliphijack/santaclaude@1.0.119

SantaClaude 커넥터 — 클라우드 예약을 내 로컬 Claude(tmux)에 발사

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a concrete, high-impact agent-control capability invoked by the user rather than an automatic npm lifecycle attack. The broad persistent mutation, remote relay, self-updating release selection, and reviewer-directed source text warrant a warning.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs santaclaude connect or starts the saved connector configuration.

Impact

Future Claude sessions can run package-installed hooks; remote commands can inject prompts, close windows, and cause project CLAUDE.md changes and commits.

Mechanism

Global Claude hook installation with a remote tmux control and screen-relay channel.

AI rationale

Evidence

santaclaude.jshooks/sc-mdsync.shhooks/mdsync-apply.js~/.claude/settings.json~/.claude/CLAUDE.md~/.claude/skills~/.santaclaudeCLAUDE.md

Network endpoints1

santaclaude.app

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Unknown with low false-positive risk.

Evidence for warning

Running the configured connector enables several global Claude hooks by default.
It adds command hooks to global Claude settings, affecting future sessions.
A SessionStart hook processes Claude transcripts, changes project CLAUDE.md files, and attempts commits.
The service receives screen captures and supplies control commands that can inject text or close tmux windows.
Its npx mode lets santaclaude.app select and launch another release of the same package.
A source comment addresses the reviewer and their Claude directly, which is reviewer manipulation.

Evidence against

package.json declares a bin only and has no install lifecycle scripts.
The risky behavior starts after a user runs and configures the connector.
No eval or arbitrary URL code loader was found in the inspected entrypoint and hooks.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Source & flagged code

12 flagged

bundled-superpowers/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs = require('fs');

4const path = require('path');

6// ========== WebSocket Protocol (RFC 6455) ==========

8const OPCODES = { TEXT: 0x01, CLOSE: 0x08, PING: 0x09, PONG: 0x0A };

9const WS_MAGIC = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';

10const MAX_FRAME_PAYLOAD_BYTES = 10 * 1024 * 1024;

12function computeAcceptKey(clientKey) {

13 return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');

14}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

16function encodeFrame(opcode, payload) {

17 const fin = 0x80;

18 const len = payload.length;

19 let header;

21 if (len < 126) {

Lines 516-556javascript

516 }

517}

518

519function broadcast(msg) {

520 const frame = encodeFrame(OPCODES.TEXT, Buffer.from(JSON.stringify

•matchType = normalized_sha256 matchedPackage = @brainervirus/workit-opencode@0.8.5 matchedPath = [redacted].cjs matchedIdentity = npm:[redacted]:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg

santaclaude.jsView file

Lines 18-96javascript

18 * 🔒 프라이버시 — 이 코드를 까보는 당신(과 당신의 Claude)에게. 과장 없이, 검증하세요.

19 *

20 * 이 파일은 "당신 PC"에서 돕니다. 무거운 일(tmux 캡처·노션 호출·파일 처리)은 전부 로컬에서.

21 * 우리 서버(Cloudflare Worker + Durable Object)는 당신 데이터를 디스크/DB에 "저장하지 않습니다"

bundled-superpowers/skills/systematic-debugging/find-polluter.shView file

•path = bundled-superpowers/skills/systematic-debugging/find-polluter.sh kind = build_helper sizeBytes = 1528 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bundled-superpowers/skills/systematic-debugging/find-polluter.shView on unpkg

bundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1View on unpkg

bundled-superpowers/skills/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @abblor/agent-os@0.11.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-superpowers/skills/writing-skills/render-graphs.jsView on unpkg

Source & flagged code

12 flagged · loading source

bundled-superpowers/skills/brainstorming/scripts/server.cjsView file

536const url = companionUrl(); // must carry the key or the gate 403s it L537: const cp = require('child_process'); L538: // Operator-provided launcher: run as given (this env var is trusted operator input).

High

Child Process

Package source references child process execution.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L536

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Findings

1 Critical10 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltasantaclaude.js

HighChild Processbundled-superpowers/skills/brainstorming/scripts/server.cjs

HighShell

HighSame File Env Network Executionsantaclaude.js

HighCommand Output Exfiltrationsantaclaude.js

HighExternal Ai Agent Control Surface Mutationsantaclaude.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsantaclaude.js

HighRuntime Package Installsantaclaude.js

HighSemantic Analysis Limitedbundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1

HighKnown Malware Source Similaritybundled-superpowers/skills/brainstorming/scripts/server.cjs

Affected versions and remediation

This report applies to @cliphijack/santaclaude@1.0.119.

See all versions of @cliphijack/santaclaude for other recorded verdicts.

Review the evidence and your use of @cliphijack/santaclaude@1.0.119 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 10:57:05.566Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.