The remote-claude-daemon package establishes a connection to a hardcoded WebSocket relay endpoint (wss://remote-claude-relay.fly.dev). It processes inbound messages as commands executed locally, including spawning the 'claude' binary with parameters that disable permission prompts, enabling arbitrary code execution. Remote messages can also synthesize mouse movements, clicks, keyboard input, and clipboard pastes via the @nut-tree-fork/nut-js library, granting full interactive control over the user's desktop. Furthermore, the daemon captures screen frames and optional microphone audio, streaming these to the relay. Although session tokens gate access and the relay endpoint can be overridden, the default configuration connects to an author-controlled relay, exposing users to remote code execution, input injection, and desktop/audio surveillance risks.

An attacker controlling the relay server or able to intercept or obtain session tokens can execute arbitrary commands with the user's privileges, control desktop input (mouse, keyboard, clipboard), and capture screen and microphone audio. This compromises confidentiality, integrity, and availability of the affected system and user data, effectively granting full remote control and surveillance capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, users should avoid installing or running the remote-claude-daemon package, especially with default configurations that connect to the hardcoded relay. Consider network-level controls to block connections to the relay endpoint and monitor for suspicious activity related to this package.