registry / @darkhunt-security/endpoint-claude-code / 0.9.17
@darkhunt-security/endpoint-claude-code@0.9.17
Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install lifecycle scripts and exposes enrollment as an explicit command. Its session capture and transmission to the enrolled Darkhunt tenant are disclosed, with the destination shown during setup and capture configurable.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs setup/enrollment; session capture then runs on Claude Code hook events when enabled in runtime configuration.
Impact
Session content is transmitted to the enrolled Darkhunt tenant as disclosed by the package; capture can be disabled in configuration.
Mechanism
Enrollment sends the Darkhunt API key to the configured Darkhunt API. Hook events are recorded locally and shipped by a detached forwarder to the Darkhunt trace endpoint.
AI rationale
The package has no install lifecycle scripts and exposes enrollment as an explicit command. Its session capture and transmission to the enrolled Darkhunt tenant are disclosed, with the destination shown during setup and capture configurable.
Evidence
~/.darkhunt/endpoint-config.json
Network endpoints2
api.darkhunt.aiapi.darkhunt.ai/trace-hub
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes an explicit enrollment command and declares no lifecycle scripts.
- Setup tells the user which endpoint, tenant, workspace, and application will receive sessions and asks them to confirm the destination.
- The README discloses that capture includes session transcripts, thinking blocks, tool calls and results, and subagent transcripts.
- The README says session content is sent to the enrolled Darkhunt tenant and that capture can be disabled in configuration.
- Enrollment sends the Darkhunt API key as a bearer token to the configured API base URL, defaulting to api.darkhunt.ai.
- Capture runs only when runtime settings enable both the endpoint and capture; then it records session events and starts the forwarder.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
36 flaggeddist/bin/forwarder.mjsView file
19382patternName = github_pat
severity = critical
line = 19382
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/forwarder.mjsView on unpkg · L1938219382patternName = github_pat
severity = critical
line = 19382
Critical
Secret Pattern
GitHub personal access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1938219383patternName = github_oauth
severity = critical
line = 19383
Critical
Secret Pattern
GitHub OAuth access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1938319402patternName = slack_bot_token
severity = critical
line = 19402
Findings
20 Critical11 High8 Medium4 Low
CriticalCritical Secretdist/bin/forwarder.mjs
CriticalPrevious Version Dangerous Deltadist/bin/guard.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/backfill.mjs
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.17.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.