Malicious code in remote-claude-daemon (npm)
The npm package remote-claude-daemon contains malicious code that connects to a hardcoded WebSocket relay (wss://remote-claude-relay.fly.dev) enabling remote code execution, input injection, and screen/audio capture on infected systems. The package spawns the local Claude binary with disabled permission checks and provides full interactive desktop control to the relay operator.
- Disclosed
- Last updated
- Blast radius
- All users who installed remote-claude-daemon npm package
- Ecosystems
- Attack vectors
- Affected entities
- remote-claude-daemonnpm package with hardcoded malicious WebSocket relay
The npm package remote-claude-daemon contains embedded malicious functionality that establishes a persistent connection to an author-controlled WebSocket relay at wss://remote-claude-relay.fly.dev. The daemon treats inbound messages from this relay as commands executed against the local host.
The package implements multiple attack surfaces: (1) ai_query and ai_voice_query messages trigger execution of the local Claude binary with the flags --continue -p --dangerously-skip-permissions and remote-supplied prompts, enabling arbitrary code execution through Claude's agent tooling with permission checks disabled; (2) a separate handleInput path dispatches remote messages to synthesized mouse movements, clicks, keyboard keypresses (including modifier combinations), and clipboard paste operations via @nut-tree-fork/nut-js, granting full interactive desktop control; (3) the daemon captures screen frames (using native SCStream on macOS via a shipped Swift helper, and ffmpeg gdigrab/x11grab on Windows/Linux) and optional microphone PCM audio, streaming both over the relay.
Although documented as a remote-Claude bridge with session token gating and a --relay override option, the default out-of-the-box configuration wires the author-controlled endpoint into an RCE, input-injection, and screen/audio-capture surface. The relay operator, or any party obtaining a session token, performing a MITM attack, or compromising the relay itself, gains arbitrary code execution and full system control over the installer's machine.
The package was identified by Amazon Inspector and published to GitHub advisories on 2026-08-07.
Indicators of compromise
- Domains
- remote-claude-relay.fly.dev
Remediation
- Immediately uninstall remote-claude-daemon from all systems
- Audit npm package.json and lock files for any installations of remote-claude-daemon
- Revoke any credentials or sensitive data that may have been exposed on affected systems
- Inspect system logs and network traffic for connections to wss://remote-claude-relay.fly.dev or related domains
- Perform a full security audit of affected systems for unauthorized code execution, input injection, or data exfiltration
- Block the relay domain wss://remote-claude-relay.fly.dev at the network level
- Consider full system reimaging if the package was installed on production or sensitive systems
Sources
- GitHub Advisory GHSA-4qch-7gcj-fhvm · GitHub Advisory Database
Cite this entry
"Malicious code in remote-claude-daemon (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-remote-claude-daemon-npm-0qwfe3
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package