registry / Telemetry / @darkhunt-security/endpoint-claude-code / 0.9.4

@darkhunt-security/endpoint-claude-code@0.9.4

Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The package’s documented purpose is to capture and send Claude Code session traces to the enrolled Darkhunt tenant, and the setup flow asks the user to confirm that destination. However, the forwarder also reads the Claude account email and can attach it to exported spans, a personally identifying detail not clearly disclosed alongside the capture description; this warrants a warning for telemetry privacy risk.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user installs and configures the Claude Code plugin; capture starts on a subsequent session by default.

Impact

Session content and an account email may be stored together in the enrolled Darkhunt tenant. The destination and transcript capture are disclosed, but the email association is not clearly called out.

Mechanism

Session hooks spool events and launch a detached forwarder, which POSTs trace data to the enrolled Darkhunt service. The forwarder reads the account email from ~/.claude.json and can add it to spans.

AI rationale

Evidence

dist/bin/forwarder.mjsdist/bin/spool.mjshooks/hooks.jsonREADME.md~/.claude.json~/.claude/projects/**/*.jsonl~/.darkhunt/endpoint-config.json~/.darkhunt/spool/claude-code.jsonl

Network endpoints3

api.darkhunt.ai/trace-hubapi.darkhunt.ai/user-management/api/me

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The forwarder reads the signed-in Claude account email from ~/.claude.json.
Trace spans can include that email and observation input/output.
The forwarder POSTs serialized traces to the configured Darkhunt trace service.
The README describes transcript capture and says the setup flow shows the destination for confirmation.

Evidence against

Capture runs through Claude Code plugin hooks after setup, not an npm lifecycle script.
The README discloses that session content is sent to the enrolled Darkhunt tenant and documents a way to turn capture off.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 1.96 MB of source, external domains: api.darkhunt.ai, app.darkhunt.ai, github.com, registry.npmjs.org

Source & flagged code

36 flagged

dist/bin/forwarder.mjsView file

19185patternName = github_pat severity = critical line = 19185

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/bin/forwarder.mjsView on unpkg · L19185

19185patternName = github_pat severity = critical line = 19185

Critical

Secret Pattern

GitHub personal access token in dist/bin/forwarder.mjs

dist/bin/forwarder.mjsView on unpkg · L19185

19186patternName = github_oauth severity = critical line = 19186

Critical

Secret Pattern

GitHub OAuth access token in dist/bin/forwarder.mjs

dist/bin/forwarder.mjsView on unpkg · L19186

19205patternName = slack_bot_token severity = critical line = 19205

Findings

20 Critical11 High8 Medium4 Low

CriticalCritical Secretdist/bin/forwarder.mjs

CriticalPrevious Version Dangerous Deltadist/bin/status.mjs

CriticalSecret Patterndist/bin/forwarder.mjs

CriticalSecret Patterndist/bin/backfill.mjs

Affected versions and remediation

This report applies to @darkhunt-security/endpoint-claude-code@0.9.4.

See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.

Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 19:37:06.918Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @darkhunt-security/endpoint-claude-code / 0.9.4

@darkhunt-security/endpoint-claude-code@0.9.4

Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user installs and configures the Claude Code plugin; capture starts on a subsequent session by default.

Impact

Session content and an account email may be stored together in the enrolled Darkhunt tenant. The destination and transcript capture are disclosed, but the email association is not clearly called out.

Mechanism

Session hooks spool events and launch a detached forwarder, which POSTs trace data to the enrolled Darkhunt service. The forwarder reads the account email from ~/.claude.json and can add it to spans.

AI rationale

Evidence

dist/bin/forwarder.mjsdist/bin/spool.mjshooks/hooks.jsonREADME.md~/.claude.json~/.claude/projects/**/*.jsonl~/.darkhunt/endpoint-config.json~/.darkhunt/spool/claude-code.jsonl

Network endpoints3

api.darkhunt.ai/trace-hubapi.darkhunt.ai/user-management/api/me

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The forwarder reads the signed-in Claude account email from ~/.claude.json.
Trace spans can include that email and observation input/output.
The forwarder POSTs serialized traces to the configured Darkhunt trace service.
The README describes transcript capture and says the setup flow shows the destination for confirmation.

Evidence against

Capture runs through Claude Code plugin hooks after setup, not an npm lifecycle script.
The README discloses that session content is sent to the enrolled Darkhunt tenant and documents a way to turn capture off.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 1.96 MB of source, external domains: api.darkhunt.ai, app.darkhunt.ai, github.com, registry.npmjs.org

Source & flagged code

36 flagged

dist/bin/forwarder.mjsView file

19185patternName = github_pat severity = critical line = 19185

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/bin/forwarder.mjsView on unpkg · L19185

19185patternName = github_pat severity = critical line = 19185

Critical

Secret Pattern

GitHub personal access token in dist/bin/forwarder.mjs

dist/bin/forwarder.mjsView on unpkg · L19185

19186patternName = github_oauth severity = critical line = 19186

Critical

Secret Pattern

GitHub OAuth access token in dist/bin/forwarder.mjs

dist/bin/forwarder.mjsView on unpkg · L19186

19205patternName = slack_bot_token severity = critical line = 19205

Findings

20 Critical11 High8 Medium4 Low

CriticalCritical Secretdist/bin/forwarder.mjs

CriticalPrevious Version Dangerous Deltadist/bin/status.mjs

CriticalSecret Patterndist/bin/forwarder.mjs

CriticalSecret Patterndist/bin/backfill.mjs

Affected versions and remediation

This report applies to @darkhunt-security/endpoint-claude-code@0.9.4.

See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.

Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 19:37:06.918Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.