registry / @darkhunt-security/endpoint-claude-code / 0.9.24
@darkhunt-security/endpoint-claude-code@0.9.24
Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInstall metadata does not execute, and agent file reads plus the Darkhunt upload path are the stated endpoint adapter, gated on a user-created ~/.darkhunt config. The email lookup and transcript roots stay inside that enrolled capture flow.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No npm preinstall, install, or postinstall hook runs. Capture starts only when Claude loads the plugin hooks and an endpoint config already exists.
Impact
No automatic mutation of a foreign agent control surface, credential theft, or remote payload execution occurs on package install.
Mechanism
The package maps local Claude transcripts and, after explicit enrollment, forwards them to the configured Darkhunt API using the stored tenant key.
AI rationale
Install metadata does not execute, and agent file reads plus the Darkhunt upload path are the stated endpoint adapter, gated on a user-created ~/.darkhunt config. The email lookup and transcript roots stay inside that enrolled capture flow.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no install lifecycle scripts and only the explicit enroll CLI as a bin.
- Transcript helpers only locate Claude Code project sessions under the user home directory for this adapter.
- Enrollment stores a caller-supplied or browser-minted API key in the Darkhunt config directory, defaulting the API host to api.darkhunt.ai.
- Logout updates only that Darkhunt endpoint config and does not rewrite Claude agent settings.
- The spool reader throws when the endpoint config file is missing, so hooks do not ship traces before enrollment.
Evidence against
- Plugin hook manifests invoke local guard, check, and spool commands after a user installs the Claude plugin.
- The mapper reads the signed-in email from ~/.claude.json and can read session transcripts once capture is enrolled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
5 flaggeddist/bin/enroll.mjsView file
320// packages/core/dist/cli/login.js
L321: import { spawn } from "node:child_process";
L322: import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
High
Child Process
Package source references child process execution.
dist/bin/enroll.mjsView on unpkg · L320dist/bin/logout.mjsView file
10import { join } from "node:path";
L11: var CONFIG_DIR = join(homedir(), ".darkhunt");
L12:
...
L50:
L51: // node_modules/@darkhunt-security/telemetry/package.json
L52: var package_default = {
...
L58: author: "Darkhunt Limited",
L59: homepage: "https://github.com/darkhunt-security/darkhunt-telemetry-ts#readme",
L60: bugs: {
...
L207: try {
L208: return JSON.parse(readFileSync(path, "utf8"));
L209: } catch {
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/bin/logout.mjsView on unpkg · L10Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/bin/logout.mjs
HighChild Processdist/bin/enroll.mjs
HighCross File Remote Execution Contextdist/bin/forwarder.mjs
HighSemantic Analysis Limiteddist/bin/status.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.24.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.