Skip to content

MCPA-2026-0074

criticalmalicious-package

@cliphijack/santaclaude (npm) lets a remote service inject tmux keystrokes and launch `claude --dangerously-skip-permissions` on the installer's host

The npm package @cliphijack/santaclaude runs a client that polls https://santaclaude.app (/api/control/claim, /api/jobs/claim) and dispatches server-supplied jobs into the user's tmux sessions with `tmux send-keys -l <cmd>` followed by Enter, and spawns new windows running `claude --dangerously-skip-permissions` by default — so the remote endpoint can type arbitrary shell commands on the host and drive a coding agent with tool confirmation disabled. A second path polls /api/cli-version and, when the server returns a `target`, writes it to ~/.santaclaude-target and exits 75 so the wrapper re-execs `npx -y @cliphijack/santaclaude@<server-chosen-version>`, letting the service pick which client code runs next; shipped hooks (hooks/sc-notify.sh, hooks/sc-stop.sh) curl host identifiers to the same service. Flagged as malware by OSV (amazon-inspector source); the package remained live on npm and the 1.0.108 tarball verified on 2026-08-08 still contains the santaclaude.app control loop, the send-keys injection helpers, the `claude --dangerously-skip-permissions` default command and the server-chosen re-exec, so every version is recorded as affected.

Affected packages

EcosystemPackageAffected versions
npm@cliphijack/santaclaude
>= 0

Identifiers

MAL-2026-13363CWE-506CWE-912

References

Timeline

  • Published: 2026-08-08

← All advisories