@darkhunt-security/endpoint-claude-code@0.9.3
Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package collects Claude Code session traces and uploads them to the Darkhunt tenant selected during setup. The README discloses the captured data and destination, and setup asks the user to confirm routing; the inspected credential flow uses a Darkhunt API key with the Darkhunt API.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user installs the Claude Code plugin and runs its setup/enrollment flow; capture begins in subsequent sessions.
Impact
Session content, including user and assistant messages and tool results, is transmitted to the selected Darkhunt tenant. The package discloses this and setup asks the user to confirm the destination.
Mechanism
Session hooks write events to a local spool, and a detached forwarder sends trace records to the enrolled Darkhunt endpoint using the Darkhunt API key.
AI rationale
The package collects Claude Code session traces and uploads them to the Darkhunt tenant selected during setup. The README discloses the captured data and destination, and setup asks the user to confirm routing; the inspected credential flow uses a Darkhunt API key with the Darkhunt API.
Evidence
~/.darkhunt/endpoint-config.json~/.darkhunt/spool
Network endpoints1
api.darkhunt.ai
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a Darkhunt endpoint adapter for Claude Code.
- The README discloses capture of session transcripts, including messages, thinking blocks, tool calls and results.
- The README says session content is sent to the enrolled Darkhunt tenant, and that status shows the destination.
- Setup asks the user to confirm the endpoint, tenant, workspace and application before capture begins.
- Enrollment uses a Darkhunt API key and defaults to https://api.darkhunt.ai; its requests use the configured base URL.
- The spool records events only when runtime configuration and capture are enabled; the forwarder sends records to its configured endpoint.
Evidence against
- Session content leaves the machine, including potentially sensitive conversation and tool data.
- Capture runs from Claude Code session hooks after setup and is on by default once configured.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
35 flaggeddist/bin/forwarder.mjsView file
19165patternName = github_pat
severity = critical
line = 19165
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/forwarder.mjsView on unpkg · L1916519165patternName = github_pat
severity = critical
line = 19165
Critical
Secret Pattern
GitHub personal access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1916519166patternName = github_oauth
severity = critical
line = 19166
Critical
Secret Pattern
GitHub OAuth access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1916619185patternName = slack_bot_token
severity = critical
line = 19185
Findings
20 Critical10 High8 Medium4 Low
CriticalCritical Secretdist/bin/forwarder.mjs
CriticalPrevious Version Dangerous Deltadist/bin/status.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/backfill.mjs
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.3.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.