MCPA-2026-0081
claude-remote-agent 0.1.0-0.2.0 (npm) defaults to an author-controlled relay that remote-drives a local Claude PTY session
claude-remote-agent runs a daemon that connects to a WebSocket relay and, on relay request, spawns a Python PTY bridge to run `claude` sessions in the host's working directory, forwarding terminal I/O to the relay and supporting a `bypassPermissions` permission mode. In 0.1.0 through 0.2.0 the relay URL defaulted to the hardcoded author-controlled endpoint `wss://claude.pishchykau.eu` (`process.env.SERVER_URL || 'wss://claude.pishchykau.eu'`), so simply running the CLI handed interactive shell/agent control of the machine to a third-party server. Flagged as malware by OSV (MAL-2026-13376, versions 0.1.0-0.1.2). Verified by unpacking every published version: 0.1.0-0.2.0 carry the hardcoded default, while 0.3.0 and later require an explicit `--server` URL and exit without one, so 0.2.0 is recorded as the last affected version.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | claude-remote-agent | >= 0.1.0, <= 0.2.0 |
Identifiers
MAL-2026-13376GHSA-vmfr-7cqr-9wc8CWE-506CWE-798
References
- advisory https://osv.dev/vulnerability/MAL-2026-13376
- advisory https://github.com/advisories/GHSA-vmfr-7cqr-9wc8
- web https://www.npmjs.com/package/claude-remote-agent
Timeline
- Published: 2026-08-09