registry / @darkhunt-security/endpoint-claude-code / 0.9.25
@darkhunt-security/endpoint-claude-code@0.9.25
Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a first-party Claude Code capture plugin with no npm lifecycle hook. Session reads and uploads start only after explicit enrollment and send traces to that enrolled Darkhunt API, so the agent-path reads are package-aligned and user-invoked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user installs the Claude plugin and runs enroll or setup. npm install does not execute package code.
Impact
Enrolled session content is sent to the user-selected Darkhunt tenant. Without a local config file, the spool path does nothing.
Mechanism
Hook scripts spool session events only when local runtime settings exist and capture is enabled. A detached forwarder then uploads those events with the stored API key to the enrolled base URL.
AI rationale
This is a first-party Claude Code capture plugin with no npm lifecycle hook. Session reads and uploads start only after explicit enrollment and send traces to that enrolled Darkhunt API, so the agent-path reads are package-aligned and user-invoked.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall scripts. The only bin is endpoint-claude-code pointing at dist/bin/enroll.mjs.
- The forwarder, status, and backfill transcript mappers list only ~/.claude/projects as session roots. They run after the user enrolls, not during npm install.
- Enrollment takes a caller-supplied API key and defaults the API base to https://api.darkhunt.ai when no flag, environment value, or saved base is present.
- The forwarder constructs DarkhuntTelemetry with baseUrl and apiKey from the local enrolled config and posts traces there.
- spool.mjs appends events and spawns the forwarder only when loadRuntimeSettings succeeds and both enabled and capture.enabled are true. A missing config throws and is swallowed.
- logout.mjs clears the local Darkhunt endpoint credential file and marks the local config signed out.
Evidence against
- After the user installs the Claude plugin and enrolls, later sessions automatically spool transcripts and a detached forwarder ships them to the enrolled Darkhunt endpoint.
- Once a config file exists, capture defaults to enabled unless the user signs out or turns it off.
Source & flagged code
5 flaggeddist/bin/enroll.mjsView file
325// packages/core/dist/cli/login.js
L326: import { spawn } from "node:child_process";
L327: import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
High
Child Process
Package source references child process execution.
dist/bin/enroll.mjsView on unpkg · L325dist/bin/logout.mjsView file
10import { join } from "node:path";
L11: var CONFIG_DIR = join(homedir(), ".darkhunt");
L12:
...
L20: function resolveProfile(explicit, fromConfig) {
L21: return explicit ?? process.env["DARKHUNT_PROFILE"] ?? fromConfig ?? DEFAULT_PROFILE;
L22: }
...
L71:
L72: // node_modules/@darkhunt-security/telemetry/package.json
L73: var package_default = {
...
L79: author: "Darkhunt Limited",
L80: homepage: "https://github.com/darkhunt-security/darkhunt-telemetry-ts#readme",
L81: bugs: {
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/bin/logout.mjsView on unpkg · L10Findings
1 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/bin/logout.mjs
HighChild Processdist/bin/enroll.mjs
HighCross File Remote Execution Contextdist/bin/forwarder.mjs
HighSemantic Analysis Limiteddist/bin/status.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.25.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.