MAL-2026-13209

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@guangnao/claude-cli/MAL-2026-13209.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13209
Published
2026-08-05T15:52:10Z
Modified
2026-08-06T23:50:00.274286879Z
Summary
Malicious code in @guangnao/claude-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b9276dba65fd393d94c5beb06122b1297994c96bda03d940f34fcc59016e4c5b)

The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespoke base64+XOR decoder (function _deHub, XOR key 'gnP2p!7xQ'). The decoder is used exactly once, to reconstruct this single URL; no other strings in the bundle use it. On claude-cli start, this hidden hub is added by default to the active hub list (opt-out only, undocumented), while the README presents hub participation as an opt-in feature the user manually configures. Once started, the CLI opens a WebSocket to <hub>/node, and on receiving {t:"job", id, body} messages it POSTs the remote-supplied body to the installer's local http://127.0.0.1:<port>/v1/messages endpoint using the local API key (x-api-key header) and streams the response back over the WebSocket. In default mode this dispatches a claude -p child process on the installer's machine driven by attacker-controlled prompts, consuming the installer's paid Anthropic subscription and, given agentic/tool-enabled Claude sessions, exposing remote-controlled execution paths on the installer's host. The targeted obfuscation of the destination URL, the mismatch between documented opt-in behavior and actual default-on enrollment, and the remote job-dispatch channel together constitute a backdoor combined with silent relay of the installer's Claude credentials and quota.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:52:10Z",
            "source": "amazon-inspector",
            "sha256": "9abec58567a8030be202b713896890f1cc6d2ae2e7db6f64db327fbbe55a7241",
            "import_time": "2026-08-05T16:13:47.184348189Z",
            "id": "IN-MAL-2026-015805",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T15:43:48Z",
            "id": "IN-MAL-2026-016659",
            "import_time": "2026-08-06T18:09:02.468377984Z",
            "sha256": "98918946c0c83f0ebad00a49a556b03c1fae32b871dc914d37b88503f00af399",
            "versions": [
                "1.0.12"
            ]
        },
        {
            "modified_time": "2026-08-06T15:43:09Z",
            "source": "amazon-inspector",
            "sha256": "b9276dba65fd393d94c5beb06122b1297994c96bda03d940f34fcc59016e4c5b",
            "import_time": "2026-08-06T18:09:02.361048967Z",
            "id": "IN-MAL-2026-016658",
            "versions": [
                "1.0.13"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @guangnao/claude-cli

Package

Name
@guangnao/claude-cli
View open source insights on deps.dev
Purl
pkg:npm/%40guangnao/claude-cli

Affected ranges

Affected versions

1.*
1.0.5
1.0.12
1.0.13

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "claude-cli-1.0.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-Tbm/ONPRd6yAT6fS5N4ItsUJuFDxYbx0md4N3jY6GOKZzGeJYmJCMWyPERJBhv5DsZvw7cOzaH8rqFpUuNci8g==",
                "sha1": "44fbeea15bd0f171fc226c1b764338878c199782"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "17a32ca9b36a213f43ec91a0d83a5807e3b599a4240d405cf27cdddf6b5c845a1befb4",
            "sha256": "4fb35fc9c11e82f1a3aefd1162df26c7926bbb6ad69a42dc588c348fd9712259",
            "path": "bin/claude-cli.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@guangnao/claude-cli/MAL-2026-13209.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]