The santaclaude binary in the @cliphijack/santaclaude npm package opens a persistent WebSocket connection to santaclaude.app and long-polls a control API endpoint. Commands received are executed as shell keystrokes in tmux sessions, enabling arbitrary command execution. It can spawn new tmux windows running an AI coding agent configured to bypass tool-use confirmations, further escalating control. Additionally, the package polls for updates from the server and can re-execute a server-chosen package version, allowing dynamic remote code execution. Shell hooks send host identifiers back to the server. This architecture provides an unauthenticated remote-control channel into the host shell and agent.

An attacker controlling the remote server can execute arbitrary shell commands on the victim's host via tmux sessions, potentially leading to full system compromise. The remote server can also force the client to update to any version it chooses, enabling persistent and evolving malicious control. Host identifiers are exfiltrated to the attacker, facilitating tracking or targeted attacks.

No official patch or remediation is currently available. Users should immediately uninstall the @cliphijack/santaclaude package and avoid running it. Monitor for any unexpected tmux sessions or network connections to santaclaude.app. Since the package allows unauthenticated remote control, it should be considered fully compromised if installed. Check for vendor advisories for updates on remediation.