@darkhunt-security/endpoint-claude-code@0.9.26
Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected source establishes an unrestricted destination override for a reused service credential, warranting a warning under the credential-forwarding policy. No concrete malicious install behavior or covert exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run endpoint-claude-code with an apiBaseUrl override while an existing CLI credential is available and no replacement key is supplied.
Impact
The selected endpoint can receive a credential originally issued for another destination.
Mechanism
Enrollment loads the saved API key, overrides its recorded API destination, and sends it as a bearer credential.
AI rationale
The inspected source establishes an unrestricted destination override for a reused service credential, warranting a warning under the credential-forwarding policy. No concrete malicious install behavior or covert exfiltration was found.
Evidence
dist/bin/enroll.mjs~/.darkhunt/credentials.json
Network endpoints1
api.darkhunt.ai
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Enrollment can reuse an existing Darkhunt CLI API key from ~/.darkhunt/credentials.json.
- An explicit apiBaseUrl option overrides the credential's recorded destination without destination validation.
- Enrollment sends the selected credential in an Authorization header to the selected endpoint.
- The active CLI forwards the user's apiBaseUrl flag into enrollment; package.json exposes this CLI.
Evidence against
- No npm install lifecycle hooks or runtime self-dependency are declared.
- The flagged Claude locations read transcript directories and account email rather than modifying Claude configuration.
- Browser login restricts authentication to defined Darkhunt environments; logout removes package credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/bin/enroll.mjsView file
325// packages/core/dist/cli/login.js
L326: import { spawn } from "node:child_process";
L327: import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
High
Child Process
Package source references child process execution.
dist/bin/enroll.mjsView on unpkg · L325631try {
const cli = JSON.parse(readFileSync3(cliCredentialsPath, "utf8"));
if (typeof cli.apiKey === "string" && cli.apiKey !== "") {
return {
apiKey: cli.apiKey,
so
Medium
Ai Review Evidence
Enrollment can reuse an existing Darkhunt CLI API key from ~/.darkhunt/credentials.json.
dist/bin/enroll.mjsView on unpkg · L631dist/bin/logout.mjsView file
10import { join } from "node:path";
L11: var CONFIG_DIR = join(homedir(), ".darkhunt");
L12:
...
L20: function resolveProfile(explicit, fromConfig) {
L21: return explicit ?? process.env["DARKHUNT_PROFILE"] ?? fromConfig ?? DEFAULT_PROFILE;
L22: }
...
L71:
L72: // node_modules/@darkhunt-security/telemetry/package.json
L73: var package_default = {
...
L79: author: "Darkhunt Limited",
L80: homepage: "https://github.com/darkhunt-security/darkhunt-telemetry-ts#readme",
L81: bugs: {
Findings
1 Critical3 High4 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/bin/logout.mjs
HighChild Processdist/bin/enroll.mjs
HighCross File Remote Execution Contextdist/bin/forwarder.mjs
HighSemantic Analysis Limiteddist/bin/status.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/bin/enroll.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.26.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.