@darkhunt-security/endpoint-claude-code@0.9.9
Darkhunt endpoint adapter for Claude Code: hook codec, transcript mapper, plugin manifest.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential and network behavior supports the package’s stated enrollment and session-tracing functions: the Darkhunt API key is sent to the configured Darkhunt API, and session capture is disclosed with a way to turn it off. The default background forwarding is consequential but matches the package’s documented purpose.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After the user sets up the plugin, Claude Code session hooks run and forward captured events when capture is enabled.
Impact
Session content leaves the machine and reaches the configured tenant; this collection and destination are disclosed by the package.
Mechanism
Hooks pass session events to a local spool and detached forwarder, which sends them to the enrolled Darkhunt tenant. Capture can be disabled in the endpoint configuration.
AI rationale
The flagged credential and network behavior supports the package’s stated enrollment and session-tracing functions: the Darkhunt API key is sent to the configured Darkhunt API, and session capture is disclosed with a way to turn it off. The default background forwarding is consequential but matches the package’s documented purpose.
Evidence
~/.darkhunt/endpoint-config.json
Network endpoints1
api.darkhunt.ai/trace-hub
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a Claude Code endpoint adapter and exposes an enrollment command.
- Documentation discloses that capture includes user and assistant messages, thinking blocks, tool calls and results, and subagent transcripts.
- Documentation says session content is sent to the enrolled Darkhunt tenant and provides configuration to turn off capture.
- Session hooks invoke the spool helper, which stores events locally and starts a detached forwarder when capture is enabled.
- Enrollment uses a Darkhunt API key and sends it as a bearer token to the configured API base URL.
- The forwarder defaults to Darkhunt’s trace endpoint, https://api.darkhunt.ai/trace-hub.
Evidence against
- Session capture is enabled by default after setup and includes sensitive conversation and tool data.
- Forwarding occurs automatically in the background during Claude Code sessions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
36 flaggeddist/bin/forwarder.mjsView file
19279patternName = github_pat
severity = critical
line = 19279
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/bin/forwarder.mjsView on unpkg · L1927919279patternName = github_pat
severity = critical
line = 19279
Critical
Secret Pattern
GitHub personal access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1927919280patternName = github_oauth
severity = critical
line = 19280
Critical
Secret Pattern
GitHub OAuth access token in dist/bin/forwarder.mjs
dist/bin/forwarder.mjsView on unpkg · L1928019299patternName = slack_bot_token
severity = critical
line = 19299
Findings
20 Critical11 High8 Medium4 Low
CriticalCritical Secretdist/bin/forwarder.mjs
CriticalPrevious Version Dangerous Deltadist/bin/guard.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/forwarder.mjs
CriticalSecret Patterndist/bin/backfill.mjs
Affected versions and remediation
This report applies to @darkhunt-security/endpoint-claude-code@0.9.9.
See all versions of @darkhunt-security/endpoint-claude-code for other recorded verdicts.
- Review the evidence and your use of @darkhunt-security/endpoint-claude-code@0.9.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.