MAL-2026-13376

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claude-remote-agent/MAL-2026-13376.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13376
Published
2026-08-05T21:20:12Z
Modified
2026-08-05T22:19:50.779471040Z
Summary
Malicious code in claude-remote-agent (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9416d15abb1ba3947af0a74a696052f6b32ec0a1d18a0e753273da4806f534ae)

claude-remote-agent connects to a hardcoded WebSocket server at wss://claude.pishchykau.eu and exposes the installer's host to remote control. In agent.js, on 'create-session' and 'input' messages the package spawns pty-bridge.py which execs the local claude CLI inside a PTY and writes network-received bytes directly to the process's stdin, giving the remote party an interactive terminal that includes Claude Code's Bash tool (arbitrary command execution on the host). A 'claude -p' variant is also spawned with prompts arriving over the same WebSocket. On 'request' messages with action 'list-conversations' or 'get-conversation', the agent reads ~/.claude/projects/*.jsonl (Claude Code conversation transcripts, including executed shell commands, file paths, and prompts) and sends the contents back to the same hardcoded server. The destination is a fixed author-controlled host, not a caller-configured endpoint, so once the agent is launched the remote side holds control of the host and of the local Claude conversation store.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T21:31:21.172800141Z",
            "modified_time": "2026-08-05T21:20:12Z",
            "sha256": "9416d15abb1ba3947af0a74a696052f6b32ec0a1d18a0e753273da4806f534ae",
            "id": "IN-MAL-2026-015893",
            "versions": [
                "0.1.2"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T21:20:41Z",
            "sha256": "9fcba747fe6b23a0d8d5a40c4b5e42dec6dfe4d03ccc7e22e5d4bb267e7be4e6",
            "id": "IN-MAL-2026-015895",
            "versions": [
                "0.1.0"
            ],
            "import_time": "2026-08-05T21:31:21.432830057Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T21:20:25Z",
            "sha256": "e178badf59c612336811ec58743e6042a1800ac4c29c339c2e1098360a59e5c7",
            "id": "IN-MAL-2026-015894",
            "versions": [
                "0.1.1"
            ],
            "import_time": "2026-08-05T21:31:21.297995794Z"
        }
    ]
}
References
Credits

Affected packages

npm / claude-remote-agent

Package

Name
claude-remote-agent
View open source insights on deps.dev
Purl
pkg:npm/claude-remote-agent

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-WqL1meVw86f+Zl+HBQHClCVJxhT+AUIZdhAmkWYIEzn6eW2SxEPO46uxq6eVUjc/WvSh/J522uiYjiz+ENCtfA==",
                "sha1": "d133030d95ec065b3d53a8fd97410ac4b02aadfe"
            },
            "filename": "claude-remote-agent-0.1.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "agent.js",
            "sha256": "4037dda40b29c91beaf279af3c5fef74704486fb4d9676f1cfc2e217e19bfb98",
            "tlsh": "c76264599cf5113502b3e8652a7b1c1363269013b398ea60b69c83d05ff9864dfe3bed"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claude-remote-agent/MAL-2026-13376.json"