@cliphijack/santaclaude@1.0.121
SantaClaude 커넥터 — 클라우드 예약을 내 로컬 Claude(tmux)에 발사
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a high-risk, explicit-user-command AI-agent integration with persistent global hooks, project instruction mutation, and screen relay. It is not an install-time attack because the manifest contains no lifecycle scripts, so it should be warned rather than blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user runs santaclaude connect or starts the configured connector.
Impact
Future Claude sessions can execute package-installed commands; project instructions and Git history may change, while terminal content is sent to the service.
Mechanism
Global Claude hook installation, transcript-derived instruction mutation, and remote screen relay.
AI rationale
This is a high-risk, explicit-user-command AI-agent integration with persistent global hooks, project instruction mutation, and screen relay. It is not an install-time attack because the manifest contains no lifecycle scripts, so it should be warned rather than blocked.
Evidence
santaclaude.jshooks/mdsync-apply.js~/.claude/settings.json~/.claude/CLAUDE.md~/.santaclaude/CLAUDE.md
Network endpoints1
santaclaude.app
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Running the CLI enables several global Claude hooks by default.
- The installed SessionStart hook uses an AI model to derive rules from prior transcripts, then changes and commits the project's CLAUDE.md.
- The connector sends captured tmux screens to santaclaude.app during its heartbeat.
- When run through npx, it obtains and executes a server-selected release of itself.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The behavior starts only after an explicit CLI connect or run command, not package installation.
- The hook scripts and configuration writes are visible in source rather than obfuscated.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcebundled-superpowers/skills/brainstorming/scripts/server.cjsView file
536const url = companionUrl(); // must carry the key or the gate 403s it
L537: const cp = require('child_process');
L538: // Operator-provided launcher: run as given (this env var is trusted operator input).
High
Child Process
Package source references child process execution.
bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L536•matchType = normalized_sha256
matchedPackage = @brainervirus/workit-opencode@0.8.5
matchedPath = [redacted].cjs
matchedIdentity = npm:[redacted]:0.8.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg1const crypto = require('crypto');
L2: const http = require('http');
L3: const fs = require('fs');
...
L12: function computeAcceptKey(clientKey) {
L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');
L14: }
...
L84:
L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null;
L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383);
...
L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {}
L196: location.replace('/');
L197: </script>
Findings
10 High4 Medium4 Low
HighChild Processbundled-superpowers/skills/brainstorming/scripts/server.cjs
HighShell
HighSame File Env Network Executionsantaclaude.js
HighCommand Output Exfiltrationsantaclaude.js
HighExternal Ai Agent Control Surface Mutationsantaclaude.js
HighTrigger Reachable External Ai Agent Control Surface Mutationsantaclaude.js
HighRuntime Package Installsantaclaude.js
HighSemantic Analysis Limitedbundled-superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritybundled-superpowers/skills/brainstorming/scripts/server.cjs
HighKnown Malware Source Similaritybundled-superpowers/skills/writing-skills/render-graphs.js
Affected versions and remediation
This report applies to @cliphijack/santaclaude@1.0.121.
See all versions of @cliphijack/santaclaude for other recorded verdicts.
- Review the evidence and your use of @cliphijack/santaclaude@1.0.121 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.