@darkhunt-security/endpoint-claude-code@0.9.0
⚠ Under reviewDarkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 41 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
34 flaggeddist/bin/forwarder.mjsView file
19143patternName = github_pat
severity = critical
line = 19143
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/forwarder.mjsView on unpkg · L1914319143patternName = github_pat
severity = critical
line = 19143
Critical
Secret Pattern
GitHub personal access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1914319144patternName = github_oauth
severity = critical
line = 19144
Critical
Secret Pattern
GitHub OAuth access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1914419163patternName = slack_bot_token
severity = critical
line = 19163
Findings
19 Critical10 High8 Medium4 Low
CriticalCritical Secretdist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/backfill.mjs
CriticalSecret Patterndist/bin/backfill.mjs
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.0.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.