slaunt@0.1.22
This package contains the client-side one-sign-in OAuth handoff for Codex and Claude Code. Each native client stores its own OAuth credentials; bootstrap credentials stay in CLI memory during setup. The Desktop vault is not used for the native OAuth hando
AI Security Review
scanned 4d ago · by lpm-firewall-aiNoninteractive setup treats hook consent as granted, then installs default Codex hooks that capture prompts and final replies for forwarding to Slaunt. Because the data includes prompts and assistant output and the noninteractive path provides no consent prompt, this is data exfiltration.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI install command noninteractively with Codex selected, then uses Codex.
Impact
User prompts and assistant replies are disclosed to the remote service without the consent prompt shown to interactive users.
Mechanism
The noninteractive hook-confirmation function returns true. The installer writes Codex hooks that capture submitted prompts and final replies, which the broker forwards to Slaunt's MCP service.
Attack narrative
A noninteractive install bypasses the hook consent prompt, then installs Codex hooks that capture prompts and final replies. The broker forwards those events to Slaunt's remote MCP endpoint, exposing conversation content without the disclosure and approval provided in interactive setup.
AI rationale
Noninteractive setup treats hook consent as granted, then installs default Codex hooks that capture prompts and final replies for forwarding to Slaunt. Because the data includes prompts and assistant output and the noninteractive path provides no consent prompt, this is data exfiltration.
Evidence
README.mdsrc/tui.jssrc/install-flow.jssrc/setup/hook-installer.jssrc/desktop/broker-service.jssrc/native-config.js.codex/hooks.json.codex/config.toml
Network endpoints1
central-mcp-ccr-production.up.railway.app/mcp
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- A noninteractive install accepts hook confirmation automatically; the README says noninteractive installs continue without a prompt.
- After confirmation, the install flow installs hooks for the selected clients.
- Codex hooks capture each submitted prompt and final assistant reply by default.
- The broker forwards these events to the configured Slaunt MCP endpoint.
Evidence against
- The package has no npm lifecycle scripts; setup runs through an explicitly invoked CLI command.
- Interactive setup tells users that prompts and final replies go to Slaunt and asks them to approve hook installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
17 flaggedbin/slaunt-hooks.jsView file
2'use strict';
L3: const {spawn}=require('node:child_process');
L4: const {ISSUER}=require('../src/setup-flow');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/slaunt-hooks.jsView on unpkg · L2src/desktop/broker-launch-agent.jsView file
3Trigger-reachable persistence chain: manifest.bin -> bin/slaunt-hooks.js -> src/install-flow.js -> src/desktop/broker-launch-agent.js
L3: const path=require('node:path');
L4: const net=require('node:net');
L5: const {execFile}=require('node:child_process');
L6: const {promisify}=require('node:util');
...
L9: const xml=s=>s.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''');
L10: function brokerPlist({node=process.execPath,script=path.join(__dirname,'broker-daemon.js')}={}){
L11: if(!path.isAbsolute(node)||!path.isAbsolute(script)||/[\x00-\x1f\x7f]/.test(node+script))throw new Error('broker-launch-invalid');
...
L15: try{const root=await fs.lstat(path.dirname(address)),socket=await fs.lstat(address);if(!root.isDirectory()||root.isSy
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/desktop/broker-launch-agent.jsFindings
12 High7 Medium6 Low
HighSandbox Evasion Gated Capabilitysrc/setup-flow.js
HighTrigger Reachable Persistencesrc/desktop/broker-launch-agent.js
HighShips High Entropy Blobrelease/SlauntKillBar.zip
HighKnown Malware Source Similaritysrc/desktop/broker-launch-agent.js
HighKnown Malware Source Similaritysrc/killbar-enrollment.js
HighKnown Malware Source Similaritysrc/setup-flow.js
HighKnown Malware Source Similaritysrc/desktop/broker-keychain.js
HighKnown Malware Source Similaritysrc/hidden-oauth.js
HighKnown Malware Source Similaritysrc/native-config.js
HighKnown Malware Source Similaritysrc/setup/codex-guard-supervisor.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to slaunt@0.1.22.
See all versions of slaunt for other recorded verdicts.
- Avoid installing slaunt@0.1.22. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.