{"id":"MAL-2026-13376","summary":"Malicious code in claude-remote-agent (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9416d15abb1ba3947af0a74a696052f6b32ec0a1d18a0e753273da4806f534ae)\nclaude-remote-agent connects to a hardcoded WebSocket server at wss://claude.pishchykau.eu and exposes the installer's host to remote control. In agent.js, on 'create-session' and 'input' messages the package spawns pty-bridge.py which execs the local `claude` CLI inside a PTY and writes network-received bytes directly to the process's stdin, giving the remote party an interactive terminal that includes Claude Code's Bash tool (arbitrary command execution on the host). A 'claude -p' variant is also spawned with prompts arriving over the same WebSocket. On 'request' messages with action 'list-conversations' or 'get-conversation', the agent reads ~/.claude/projects/*.jsonl (Claude Code conversation transcripts, including executed shell commands, file paths, and prompts) and sends the contents back to the same hardcoded server. The destination is a fixed author-controlled host, not a caller-configured endpoint, so once the agent is launched the remote side holds control of the host and of the local Claude conversation store.\n","modified":"2026-08-05T21:45:14.232098664Z","published":"2026-08-05T21:20:12Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015893","import_time":"2026-08-05T21:31:21.172800141Z","modified_time":"2026-08-05T21:20:12Z","sha256":"9416d15abb1ba3947af0a74a696052f6b32ec0a1d18a0e753273da4806f534ae","source":"amazon-inspector","versions":["0.1.2"]},{"import_time":"2026-08-05T21:31:21.432830057Z","modified_time":"2026-08-05T21:20:41Z","sha256":"9fcba747fe6b23a0d8d5a40c4b5e42dec6dfe4d03ccc7e22e5d4bb267e7be4e6","source":"amazon-inspector","versions":["0.1.0"],"id":"IN-MAL-2026-015895"},{"source":"amazon-inspector","versions":["0.1.1"],"id":"IN-MAL-2026-015894","import_time":"2026-08-05T21:31:21.297995794Z","modified_time":"2026-08-05T21:20:25Z","sha256":"e178badf59c612336811ec58743e6042a1800ac4c29c339c2e1098360a59e5c7"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claude-remote-agent/v/0.1.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/claude-remote-agent/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/claude-remote-agent/v/0.1.1"}],"affected":[{"package":{"name":"claude-remote-agent","ecosystem":"npm","purl":"pkg:npm/claude-remote-agent"},"versions":["0.1.2","0.1.0","0.1.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"agent.js","sha256":"4037dda40b29c91beaf279af3c5fef74704486fb4d9676f1cfc2e217e19bfb98","tlsh":"c76264599cf5113502b3e8652a7b1c1363269013b398ea60b69c83d05ff9864dfe3bed"}],"package_integrity":[{"filename":"claude-remote-agent-0.1.2.tgz","hashes":{"sha512_sri":"sha512-WqL1meVw86f+Zl+HBQHClCVJxhT+AUIZdhAmkWYIEzn6eW2SxEPO46uxq6eVUjc/WvSh/J522uiYjiz+ENCtfA==","sha1":"d133030d95ec065b3d53a8fd97410ac4b02aadfe"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claude-remote-agent/MAL-2026-13376.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}