registry / Credential exfiltration / @guangnao/claude-cli

@guangnao/claude-cli

Serve several claude subscription identities behind one Anthropic-compatible /v1/messages endpoint. No containers, no runtime dependencies.

This report shows the evidence for @guangnao/claude-cli@1.0.17. 9 of 11 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a concrete, concealed credential-exfiltration chain activated by ordinary CLI use. The lack of install hooks does not mitigate the undisclosed default remote upload.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs claude-cli or claude-cli start.

Impact

Remote operator can receive Claude OAuth credentials and long-lived tokens.

Mechanism

hidden default hub credential backup upload

Attack narrative

The executable XOR-decodes a built-in hub URL and enables it by default unless a local opt-out is already present. On startup it reads Claude Code credentials and configured identity tokens, serializes them, and PUTs the blob to that hub's backup endpoint. The documented hub command implies an explicit user choice, but the concealed default bypasses it.

AI rationale

This is a concrete, concealed credential-exfiltration chain activated by ordinary CLI use. The lack of install hooks does not mitigate the undisclosed default remote upload.

Evidence

package.jsonREADME.mdbin/claude-cli.js~/.claude/.credentials.json~/.claude-cli/*/token~/.claude-cli/hub.json

Network endpoints1

hub.client-llm.com/node/backup/{node-id}

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Obfuscated default hub decodes to https://hub.client-llm.com.
Default hub is enabled unless state explicitly sets defaultOff.
Startup collects ~/.claude/.credentials.json and ~/.claude-cli/*/token.
It PUTs the collected credential/token JSON to /node/backup/{node-id}.
README documents only user-configured hubs, not the built-in default hub.

Evidence against

package.json has no install lifecycle scripts.
Credential access occurs when the CLI is started, not at npm install.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 117 KB of source, external domains: registry.npmjs.org

Source & flagged code

7 flagged

bin/claude-cli.jsView file

8\r L9: `+n)}o(Ue,"abortHandshake");function le(e,t,n,r,s,i){if(e.listenerCount("wsClientError")){let a=new Error(s);Error.captureStackTrace(a,le),e.emit("wsClientError",a,n,t)}else Ue(n,r... L10: `,{mode:384})}catch{}return n}o(fe,"nodeId");var bn="gnP2p!7xQ",ki=o(e=>{let t=Buffer.from(e,"base64"),n="";for(let r=0;r<t.length;r++)n+=String.fromCharCode(t[r]^bn.charCodeAt(r%b...

High

Child Process

Package source references child process execution.

bin/claude-cli.jsView on unpkg · L8

2import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var ri=Object.create;var wt=Object.defineProperty;var si=Object.getOwnPropertyDescriptor;var ii=Object.getOwnPropertyNames;var oi=Object.getPrototypeOf,ai=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}o(Ue,"abortHandshake");function le(e,t,n,r,s,i){if(e.listenerCount("wsClientError")){let a=new Error(s);Error.captureStackTrace(a,le),e.emit("wsClientError",a,n,t)}else Ue(n,r... L10: `,{mode:384})}catch{}return n}o(fe,"nodeId");var bn="gnP2p!7xQ",ki=o(e=>{let t=Buffer.from(e,"base64"),n="";for(let r=0;r<t.length;r++)n+=String.fromCharCode(t[r]^bn.charCodeAt(r%b...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-cli.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/claude-cli.jsView on unpkg · L2

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/claude-cli.jsView on unpkg · L2

2Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/claude-cli.js L2: import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url); L3: var ri=Object.create;var wt=Object.defineProperty;var si=Object.getOwnPropertyDescriptor;var ii=Object.getOwnPropertyNames;var oi=Object.getPrototypeOf,ai=Object.prototype.hasOwnPr... L4: `).join(`\r ... L8: \r L9: `+n)}o(Ue,"abortHandshake");function le(e,t,n,r,s,i){if(e.listenerCount("wsClientError")){let a=new Error(s);Error.captureStackTrace(a,le),e.emit("wsClientError",a,n,t)}else Ue(n,r... L10: `,{mode:384})}catch{}return n}o(fe,"nodeId");var bn="gnP2p!7xQ",ki=o(e=>{let t=Buffer.from(e,"base64"),n="";for(let r=0;r<t.length;r++)n+=String.fromCharCode(t[r]^bn.charCodeAt(r%b... ... L14: `).slice(-t).joi

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/claude-cli.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @guangnao/claude-cli@1.0.7 matchedPath = bin/claude-cli.js matchedIdentity = npm:QGd1YW5nbmFvL2NsYXVkZS1jbGk:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/claude-cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1fef0233fc33903f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @guangnao/claude-cli@1.0.7 matchedPath = bin/claude-cli.js matchedIdentity = npm:QGd1YW5nbmFvL2NsYXVkZS1jbGk:1.0.7 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/claude-cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

bin/claude-cli.jsView file

High

Child Process

Package source references child process execution.

bin/claude-cli.jsView on unpkg · L8

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/claude-cli.jsView on unpkg · L2

Findings

7 High3 Medium3 Low

HighChild Processbin/claude-cli.js

HighSame File Env Network Executionbin/claude-cli.js

HighCommand Output Exfiltrationbin/claude-cli.js

HighSandbox Evasion Gated Capabilitybin/claude-cli.js

HighTrigger Reachable Command Output Exfiltrationbin/claude-cli.js

HighKnown Malware Source Similaritybin/claude-cli.js

HighKnown Malware Source Fingerprint Signaturebin/claude-cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @guangnao/claude-cli@1.0.17.

The versions list below shows the verdict for each recorded version.

Avoid installing @guangnao/claude-cli@1.0.17. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-10 01:27:08.470Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

1.0.17latestshownMaliciousCredential ExfiltrationBlockPublishedAug 6, 2026, 6:05 PM 1.0.16SuspiciousCredential ExfiltrationWarnPublishedAug 6, 2026, 5:38 PM 1.0.15SuspiciousRemote Code ExecutionWarnPublishedAug 6, 2026, 4:24 PM 1.0.13MaliciousMalwareBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @guangnao

Other credential exfiltration packages

Behavioral surface

Related packages

More from @guangnao

Other credential exfiltration packages

Source & flagged code