MAL-2026-13376

    Dashboard / Malicious Package / MAL-2026-13376

    MAL-2026-13376

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in claude-remote-agent (npm)

    Details: Source: amazon-inspector (9416d15abb1ba3947af0a74a696052f6b32ec0a1d18a0e753273da4806f534ae) claude-remote-agent connects to a hardcoded WebSocket server at wss://claude.pishchykau.eu and exposes the installer's host to remote control. In agent.js, on 'create-session' and 'input' messages the package spawns pty-bridge.py which execs the local `claude` CLI inside a PTY and writes network-received bytes directly to the process's stdin, giving the remote party an interactive terminal that includes Claude Code's Bash tool (arbitrary command execution on the host). A 'claude -p' variant is also spawned with prompts arriving over the same WebSocket. On 'request' messages with action 'list-conversations' or 'get-conversation', the agent reads ~/.claude/projects/*.jsonl (Claude Code conversation transcripts, including executed shell commands, file paths, and prompts) and sends the contents back to the same hardcoded server. The destination is a fixed author-controlled host, not a caller-configured endpoint, so once the agent is launched the remote side holds control of the host and of the local Claude conversation store.

    References: https://www.npmjs.com/package/claude-remote-agent/v/0.1.2, https://www.npmjs.com/package/claude-remote-agent/v/0.1.0, https://www.npmjs.com/package/claude-remote-agent/v/0.1.1

    Affected packages

    Package

    Name: claude-remote-agent

    Purl: pkg:npm/claude-remote-agent

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.2
    0.1.0
    0.1.1