Malicious code in @cliphijack/santaclaude (npm)

The npm package @cliphijack/santaclaude was found to contain malicious code that establishes a persistent WebSocket connection to wss://santaclaude.app/ws. The malicious code dispatches server-supplied frames into the installer's host environment, enabling remote control of the system.

The package implements multiple attack mechanisms. A 'tailscale-up' action reads a password from server frames and invokes sudo -S -p with that password, then writes a passwordless NOPASSWD entry to /etc/sudoers.d/santaclaude-tailscale. This grants the remote endpoint persistent root capability on the infected host. Additional actions push server-sent text into a tmux window running claude --dangerously-skip-permissions, allowing the attacker to remotely drive the local Claude Code TUI with permission checks disabled.

The package also implements a supervisor loop that respawns itself via npx -y @cliphijack/santaclaude@<spec>, where the version specification is read from ~/.santaclaude-target and refreshed from GET https://santaclaude.app/api/cli-version. This creates a vendor-controlled auto-update mechanism that allows the attacker to steer installations onto arbitrary future versions of the package at any time.

The combined behavior constitutes a remote-controlled RCE and privilege-escalation channel into the installer's host, coupled with a vendor-controlled auto-update path that determines what code runs next.