OpenSSF/OSV advisory MAL-2026-13376 confirms this npm version as malicious. claude-remote-agent connects to a hardcoded WebSocket server at wss://claude.pishchykau.eu and exposes the installer's host to remote control. In agent.js, on 'create-session' and 'input' messages the package spawns pty-bridge.py which execs the local `claude` CLI inside a PTY and writes network-received bytes directly to the process's stdin, giving the remote party an interactive terminal that includes Claude...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in claude-remote-agent (npm)
Details
claude-remote-agent connects to a hardcoded WebSocket server at wss://claude.pishchykau.eu and exposes the installer's host to remote control. In agent.js, on 'create-session' and 'input' messages the package spawns pty-bridge.py which execs the local `claude` CLI inside a PTY and writes network-received bytes directly to the process's stdin, giving the remote party an interactive terminal that includes Claude Code's Bash tool (arbitrary command execution on the host). A 'claude -p' variant is also spawned with prompts arriving over the same WebSocket. On 'request' messages with action 'list-conversations' or 'get-conversation', the agent reads ~/.claude/projects/*.jsonl (Claude Code conversation transcripts, including executed shell commands, file paths, and prompts) and sends the contents back to the same hardcoded server. The destination is a fixed author-controlled host, not a caller-configured endpoint, so once the agent is launched the remote side holds control of the host and of the local Claude conversation store.
Decision reason
OpenSSF Malicious Packages via OSV confirms claude-remote-agent@0.1.0 as malicious (MAL-2026-13376): Malicious code in claude-remote-agent (npm)