@darkhunt-security/endpoint-claude-code@0.9.5
Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package performs its stated endpoint trace-capture function and discloses that session content is sent to Darkhunt. However, it also reads and transmits the user’s Claude account email for attribution, so the identifying runtime telemetry warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After setup/enrollment, Claude Code session hooks capture sessions; the forwarder processes them in the background.
Impact
Session content and account identity are associated with the user’s Darkhunt workspace, creating a privacy risk despite the plugin’s stated capture purpose.
Mechanism
The forwarder reads the Claude account email and maps session text, tool calls, and tool results into traces sent to the configured Darkhunt endpoint.
AI rationale
The package performs its stated endpoint trace-capture function and discloses that session content is sent to Darkhunt. However, it also reads and transmits the user’s Claude account email for attribution, so the identifying runtime telemetry warrants a warning.
Evidence
.claude-plugin/plugin.jsoncommands/setup.mdhooks/hooks.jsondist/bin/spool.mjsdist/bin/forwarder.mjs~/.claude.json~/.claude/projects~/.darkhunt/spool/claude-code.jsonl
Network endpoints1
api.darkhunt.ai/trace-hub (default; configurable)
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The plugin’s setup command discloses that session content is captured and sent into trace data.
- Capture defaults to enabled, and session hooks spool events when capture is enabled.
- The forwarder reads the Claude account email from ~/.claude.json for user attribution.
- The forwarder maps user and assistant text, tool inputs, and tool results into trace records sent to Darkhunt.
Evidence against
- The plugin describes its purpose as full session trace capture, and setup tells users where their sessions will go.
- Enrollment sends a Darkhunt API key to the Darkhunt API; no unrelated credential recipient was identified.
- The account email is used for attribution to Darkhunt’s trace service, not sent to an unrelated host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
36 flaggeddist/bin/forwarder.mjsView file
19185patternName = github_pat
severity = critical
line = 19185
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/forwarder.mjsView on unpkg · L1918519185patternName = github_pat
severity = critical
line = 19185
Critical
Secret Pattern
GitHub personal access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1918519186patternName = github_oauth
severity = critical
line = 19186
Critical
Secret Pattern
GitHub OAuth access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1918619205patternName = slack_bot_token
severity = critical
line = 19205
Findings
20 Critical11 High8 Medium4 Low
CriticalCritical Secretdist/bin/forwarder.mjs
CriticalPrevious Version Dangerous Deltadist/bin/status.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/backfill.mjs
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.5.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.