registry / Credential exfiltration / hopper-code
hopper-code
Put Hopper's coding model into OpenCode, Claude Code and Codex with one command.
This report shows the evidence for hopper-code@0.1.1. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe Claude merger redirects requests to api.withhopper.com while retaining an existing Anthropic auth token in Claude's configuration. Default verification launches Claude with the inherited environment, creating an automatic credential disclosure path to a host outside Anthropic's service.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the CLI with Claude Code configured; its default post-configuration verification launches Claude.
Impact
An Anthropic credential may be disclosed to Hopper, a host outside Anthropic's service.
Mechanism
The installer changes Claude's API base URL to api.withhopper.com while preserving existing environment values it does not replace, including a configured Anthropic auth token. Verification inherits the launcher's environment.
Attack narrative
When configuring Claude Code, the package points its API base URL at Hopper but preserves existing Claude environment values that it does not explicitly set. A preexisting ANTHROPIC_AUTH_TOKEN can therefore remain configured for requests now directed to api.withhopper.com. The launcher then verifies Claude by default and passes its environment to the child process, creating an automatic path for that credential to reach Hopper.
AI rationale
The Claude merger redirects requests to api.withhopper.com while retaining an existing Anthropic auth token in Claude's configuration. Default verification launches Claude with the inherited environment, creating an automatic credential disclosure path to a host outside Anthropic's service.
Evidence
lib/configs.mjsbin/withhopper.mjs~/.claude/settings.json
Network endpoints1
api.withhopper.com
Decision evidence
public snapshotAI called this Malicious at 86.0% confidence as Malware with low false-positive risk.
Evidence for block
- Claude configuration replaces ANTHROPIC_BASE_URL with the Hopper API URL; on Unix, authentication is set through a Hopper key helper.
- The config merger preserves existing Claude environment values when the merger does not supply replacements, including a preexisting ANTHROPIC_AUTH_TOKEN.
- After configuration, verification runs Claude by default, and child processes inherit process.env; this can route an existing Anthropic credential to Hopper.
Evidence against
- The package is presented as a user-invoked CLI for configuring Hopper in coding agents.
- The manifest declares no install, preinstall, or postinstall lifecycle hook.
- The launcher warns users when ANTHROPIC_API_KEY is set, though it does not address a token already stored in Claude settings.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/withhopper.mjsView file
8L9: import { spawn, spawnSync } from "node:child_process";
L10: import crypto from "node:crypto";
L11: import fs from "node:fs";
L12: import http from "node:http";
L13: import os from "node:os";
...
L28: const VERSION = "0.1.1";
L29: const SITE = process.env.HOPPER_SITE_URL ?? "https://withhopper.com";
L30: const API = process.env.HOPPER_API_URL ?? "https://api.withhopper.com";
L31: const isWin = process.platform === "win32";
L32: const HOME = os.homedir();
L33: const HOPPER_DIR = path.join(HOME, ".hopper");
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/withhopper.mjsView on unpkg · L88Trigger-reachable persistence chain: manifest.bin -> bin/withhopper.mjs
L8:
L9: import { spawn, spawnSync } from "node:child_process";
L10: import crypto from "node:crypto";
L11: import fs from "node:fs";
L12: import http from "node:http";
L13: import os from "node:os";
...
L28: const VERSION = "0.1.1";
L29: const SITE = process.env.HOPPER_SITE_URL ?? "https://withhopper.com";
L30: const API = process.env.HOPPER_API_URL ?? "https://api.withhopper.com";
L31: const isWin = process.platform === "win32";
L32: const HOME = os.homedir();
L33: const HOPPER_DIR = path.join(HOME, ".hopper");
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/withhopper.mjsView on unpkg · L8Findings
4 High4 Medium4 Low
HighSandbox Evasion Gated Capabilitybin/withhopper.mjs
HighTrigger Reachable Persistencebin/withhopper.mjs
HighAi Review Evidencelib/configs.mjs
HighAi Review Evidencebin/withhopper.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/withhopper.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hopper-code@0.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing hopper-code@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.