🛡️ MAL-2026-13363 — santaclaude

Malicious code in @cliphijack/santaclaude (npm)

Source: amazon-inspector

The santaclaude bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls /api/control/claim. Messages received from the server are dispatched to runControl(cmd), which invokes tmux send-keys -l (plus Enter) into arbitrary target windows on the user's host, spawns new tmux windows that run claude --dangerously-skip-permissions by default, and can kill or resize windows. The result is that the remote endpoint can execute arbitrary shell keystrokes in the user's tmux sessions and drive an AI coding agent that has itself been configured to bypass tool-use confirmations, yielding full-host command execution. A second path (checkUpdate()) polls /api/cli-version and, when the server returns a target value, writes it to ~/.santaclaude-target, exits with code 75, and causes the wrapper loop to re-exec npx -y @cliphijack/santaclaude@<server-chosen-version> — the version of the client that runs next is chosen by the remote server. Additional shell hooks (hooks/sc-notify.sh, hooks/sc-stop.sh) POST via curl to the same service with host identifiers. Whether or not the operator of santaclaude.app is the package author, the shipped design gives that endpoint an unauthenticated remote-control channel into the installer's shell and agent.