MAL-2026-13363

Dashboard / Malicious Package / MAL-2026-13363

MAL-2026-13363

Summary: Malicious code in @cliphijack/santaclaude (npm)

Details: Source: amazon-inspector (f6a4fa42a55635225fb914eaea97cbc9699efb6cc197445eacf32e6592b60675) The `santaclaude` bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls `/api/control/claim`. Messages received from the server are dispatched to `runControl(cmd)`, which invokes tmux `send-keys -l` (plus Enter) into arbitrary target windows on the user's host, spawns new tmux windows that run `claude --dangerously-skip-permissions` by default, and can kill or resize windows. The result is that the remote endpoint can execute arbitrary shell keystrokes in the user's tmux sessions and drive an AI coding agent that has itself been configured to bypass tool-use confirmations, yielding full-host command execution. A second path (`checkUpdate()`) polls `/api/cli-version` and, when the server returns a `target` value, writes it to `~/.santaclaude-target`, exits with code 75, and causes the wrapper loop to re-exec `npx -y @cliphijack/santaclaude@<server-chosen-version>` — the version of the client that runs next is chosen by the remote server. Additional shell hooks (`hooks/sc-notify.sh`, `hooks/sc-stop.sh`) POST via curl to the same service with host identifiers. Whether or not the operator of santaclaude.app is the package author, the shipped design gives that endpoint an unauthenticated remote-control channel into the installer's shell and agent.

References: https://www.npmjs.com/package/@cliphijack/santaclaude/v/1.0.104, https://www.npmjs.com/package/@cliphijack/santaclaude/v/1.0.106, https://www.npmjs.com/package/@cliphijack/santaclaude/v/1.0.100, https://www.npmjs.com/package/@cliphijack/santaclaude/v/1.0.107, https://www.npmjs.com/package/@cliphijack/santaclaude/v/1.0.102, https://www.npmjs.com/package/@cliphijack/santaclaude/v/1.0.103, https://www.npmjs.com/package/@cliphijack/santaclaude/v/1.0.108