Malicious npm Packages Backdoor Claude Code Sessions

Five typosquatting npm packages ship a hidden ELF binary that fires on install and re-runs via Claude Code's SessionStart hook on every developer session. C2 is 207.90.194.2:443.

Read the full article

1mo ago

programming

You might also wanna read

Undocumented Claude Code Features Revealed Through Source Code Analysis

Hook fields that rewrite commands mid-flight, persistent agent memory, auto-mode rules in plain English, self-improving dream loops, and eve

buildingbetter.tech·1mo ago

npm malware targeting Claude users leaks own GitHub token, reaches 676 downloads

Script kiddies these days

theregister.com·1mo ago

Claude Code embeds hidden system prompt markers based on API URL and timezone

I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.

thereallo.dev·10d ago

Claude Code embeds hidden system prompt markers based on API URL and timezone

I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.

thereallo.dev·10d ago

What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm

Snyk·5y ago

Visibly invisible malicious Node.js packages: When configuration niche meets invisible characters

A focus on attacks in the Node.js ecosystem via the yarn and npm package managers, examining how configuration abuse and hidden characters c

Snyk·4y ago

MAL-2026-10081: Malicious code in webrix-docs1 (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (20cdefe1415c5b5245f36b10ea0de9033433b479768c2cc785a

radar.offseq.com·1d ago

Comments

No comments yet. Be the first.