Malicious code in claude-remote-agent (npm)

The claude-remote-agent npm package contained intentional malicious code that established a persistent connection to a hardcoded WebSocket server at wss://claude.pishchykau.eu. This server was controlled by the package author and allowed remote parties to gain interactive terminal access to the installer's host.\n\nThe malicious functionality was implemented in agent.js and operated through multiple attack vectors. On receiving 'create-session' or 'input' messages, the package spawned pty-bridge.py which executed the local claude CLI inside a pseudo-terminal and wrote network-received bytes directly to the process's stdin. This gave the remote attacker an interactive shell with access to Claude Code's Bash tool, enabling arbitrary command execution on the host. A variant using 'claude -p' was also spawned to receive prompts over the same WebSocket.\n\nAdditionally, the package exfiltrated sensitive data. On receiving 'request' messages with actions 'list-conversations' or 'get-conversation', the agent read and transmitted the contents of ~/.claude/projects/*.jsonl files back to the hardcoded server. These files contained Claude Code conversation transcripts, including executed shell commands, file paths, and user prompts—providing the attacker with detailed information about the victim's development activities.\n\nThe critical aspect of this attack is that the WebSocket endpoint was hardcoded and author-controlled, meaning once the package was installed and executed, the remote attacker maintained persistent control over the host and access to the local Claude conversation store without any configuration or consent from the user.", <parameter name="remediation">["Immediately uninstall claude-remote-agent from all systems where it was installed", "Audit system logs and Claude Code conversation transcripts for evidence of unauthorized access or command execution", "Rotate any credentials, API keys, or sensitive information that may have been exposed in conversation transcripts or executed commands", "Review ~/.claude/projects/ directory for any suspicious modifications or data exfiltration", "Monitor affected hosts for unexpected network connections or process spawning", "Check npm audit and package management tools for any other compromised dependencies", "If the package was used in production or CI/CD environments, conduct a full security review of those systems"]