slaunt@0.1.19
This package contains the client-side one-sign-in OAuth handoff for Codex and Claude Code. Each native client stores its own OAuth credentials; bootstrap credentials stay in CLI memory during setup. The Desktop vault is not used for the native OAuth hando
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe explicit setup command installs Claude hooks that automatically send prompts and final assistant messages to the remote service. This content capture is not disclosed in the package README, so it is data exfiltration despite using the package’s own service.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs `slaunt-hooks install` and selects Claude Code; the hooks then run during Claude sessions.
Impact
User conversation content is disclosed to the remote service without clear notice or specific consent to capture it.
Mechanism
Claude lifecycle events pass prompt and final-response content to the `chat_hook_event` MCP tool over the authenticated connection to Slaunt’s MCP endpoint.
Attack narrative
When the user installs Slaunt hooks for Claude Code, the package registers handlers for prompt submission and session stop. Those handlers capture the submitted prompt and final assistant message, then send them as `chat_hook_event` calls over the authenticated connection to Slaunt’s remote MCP service. The README does not disclose this default content capture. The explicit setup command does not amount to specific consent to transmit conversation contents.
AI rationale
The explicit setup command installs Claude hooks that automatically send prompts and final assistant messages to the remote service. This content capture is not disclosed in the package README, so it is data exfiltration despite using the package’s own service.
Evidence
src/install-flow.jssrc/setup/hook-installer.jssrc/desktop/claude-lifecycle.jssrc/desktop/native-claude-connection.jsREADME.md~/.claude/settings.json~/Library/LaunchAgents/ai.slaunt.claude-broker.plist
Network endpoints1
central-mcp-ccr-production.up.railway.app/mcp
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The setup flow installs Slaunt hooks for the selected clients, including Claude Code.
- Claude setup registers lifecycle hooks that run on session start, prompt submission, and stop.
- The Claude prompt hook forwards the submitted prompt, and the stop hook forwards the final assistant message.
- The lifecycle handler sends those message contents to the `chat_hook_event` MCP tool.
- The Claude broker connects to `central-mcp-ccr-production.up.railway.app/mcp`.
- The README describes this as an OAuth installer and discusses Codex hook metadata, but does not disclose default Claude prompt and response capture.
Evidence against
- There are no npm lifecycle scripts; the data collection is installed through an explicit `slaunt-hooks install` command.
- The destination is Slaunt’s configured service, which is also used for the package’s OAuth and MCP integration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
14 flaggedsrc/desktop/broker-launch-agent.jsView file
3Trigger-reachable persistence chain: manifest.bin -> bin/slaunt-hooks.js -> src/install-flow.js -> src/desktop/broker-launch-agent.js
L3: const path=require('node:path');
L4: const net=require('node:net');
L5: const {execFile}=require('node:child_process');
L6: const {promisify}=require('node:util');
...
L9: const xml=s=>s.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''');
L10: function brokerPlist({node=process.execPath,script=path.join(__dirname,'broker-daemon.js')}={}){
L11: if(!path.isAbsolute(node)||!path.isAbsolute(script)||/[\x00-\x1f\x7f]/.test(node+script))throw new Error('broker-launch-invalid');
...
L15: try{const root=await fs.lstat(path.dirname(address)),socket=await fs.lstat(address);if(!root.isDirectory()||root.isSy
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/desktop/broker-launch-agent.jsView on unpkg · L3•matchType = normalized_sha256
matchedPackage = slaunt@0.1.18
matchedPath = src/desktop/broker-launch-agent.js
matchedIdentity = npm:c2xhdW50:0.1.18
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/desktop/broker-launch-agent.jsView on unpkgFindings
10 High6 Medium6 Low
HighSandbox Evasion Gated Capabilitysrc/setup-flow.js
HighTrigger Reachable Persistencesrc/desktop/broker-launch-agent.js
HighShips High Entropy Blobrelease/SlauntKillBar.zip
HighKnown Malware Source Similaritysrc/desktop/broker-launch-agent.js
HighKnown Malware Source Similaritysrc/killbar-enrollment.js
HighKnown Malware Source Similaritysrc/setup-flow.js
HighKnown Malware Source Similaritysrc/desktop/broker-keychain.js
HighKnown Malware Source Similaritysrc/native-config.js
HighKnown Malware Source Similaritysrc/setup/codex-guard-supervisor.js
HighKnown Malware Source Similaritysrc/native-oauth.js
MediumNetwork
Affected versions and remediation
This report applies to slaunt@0.1.19.
See all versions of slaunt for other recorded verdicts.
- Avoid installing slaunt@0.1.19. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.