Malicious code in @guangnao/claude-cli (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9abec58567a8030be202b713896890f1cc6d2ae2e7db6f64db327fbbe55a7241) On CLI startup, bin/claude-cli.js connects to a hardcoded fallback destination whose URL (https://hub.client-llm.com) is hidden behind an XOR+base64 decoder (`_deHub`/`Ms`) rather than stored in plain text or documented in the README. Once connected, the tool reads the user's Claude authentication material — `~/.claude/.credentials.json` and the macOS keychain entry `Claude Code-credentials`, plus per-identity token files — and PUTs the collected payload to `https://hub.client-llm.com/node/backup/<id>`. The same WebSocket (`wss://hub.client-llm.com/node`) accepts control frames from the remote hub: `{t:'job'}` messages are forwarded to the local `/v1/messages` endpoint, executed against the installer's own paid Claude subscription, and the SSE response is streamed back to the hub as `chunk`/`head`/`end` frames; `cancel` frames abort in-flight jobs. Neither the credential upload, the remote-hub connection, nor the remote-driven inference is disclosed in the README or in the documented environment-variable list. The combination of obfuscated destination, undocumented credential upload, and remote-controlled use of the installer's paid Claude account gives the operator of hub.client-llm.com both impersonation of the installer's Claude identity and ongoing use of that subscription.
Malicious code in @guangnao/claude-cli (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9abec58567a8030be202b713896890f1cc6d2ae2e7db6f64db327fbbe55a7241) On CLI startup, bin/claude-cli.js connects to a hardcoded fallback destination whose URL (https://hub.client-llm.com) is hidden behind an XOR+base64 decoder (`_deHub`/`Ms`) rather than stored in plain text or documented in the README. Once connected, the tool reads the user's Claude authentication material — `~/.claude/.credentials.json` and the macOS keychain entry `Claude Code-credentials`, plus per-identity token files — and PUTs the collected payload to `https://hub.client-llm.com/node/backup/<id>`. The same WebSocket (`wss://hub.client-llm.com/node`) accepts control frames from the remote hub: `{t:'job'}` messages are forwarded to the local `/v1/messages` endpoint, executed against the installer's own paid Claude subscription, and the SSE response is streamed back to the hub as `chunk`/`head`/`end` frames; `cancel` frames abort in-flight jobs. Neither the credential upload, the remote-hub connection, nor the remote-driven inference is disclosed in the README or in the documented environment-variable list. The combination of obfuscated destination, undocumented credential upload, and remote-controlled use of the installer's paid Claude account gives the operator of hub.client-llm.com both impersonation of the installer's Claude identity and ongoing use of that subscription.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13209
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a73851fbf8831d5394ef86a
Added to database: 08/05/2026, 18:46:55 UTC
Last updated: 08/05/2026, 18:46:55 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.