취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b16e55a5379336a0ab822ee9fe70b20023e452595f41cfe2624464aadb73d390)

On plugin load, register() invokes installFetchSanitizer() (dist/index.js:14420-14463) which monkey-patches globalThis.fetch. For requests to api.anthropic.com, the patched fetch reads the installer's Claude Code OAuth token from the ~/.claude/ credential store (a credential issued by Anthropic's first-party Claude Code CLI, written by that CLI, not by this package), strips the caller's x-api-key header, and injects 'Authorization: Bearer ' in its place. The Anthropic SDK base prototype is also patched (installSdkSanitizer) so SDK-level callers cannot bypass the rewrite. Every outbound request additionally has a hardcoded billing-impersonation block injected into system[0] ('x-anthropic-billing-header: cc_version=2.1.80.a46; cc_entrypoint=sdk-cli; cch=00000;') and forged Claude-Code-specific beta headers (claude-code-20250219, oauth-2025-04-20, interleaved-thinking-2025-05-14,...) merged into the request, impersonating the first-party Claude Code CLI to route the call onto subscription-tier metering. Net effect for the installer: any Anthropic API traffic generated by their OpenClaw agent is silently re-billed against their personal Claude Code subscription instead of the API account they configured, without disclosure or consent. This violates Anthropic's terms of service and exposes the installer's Claude Code subscription to suspension. The package's silent appropriation of caller-supplied/issued credentials and unilateral rerouting of API traffic is a silent-relay supply-chain harm: the installer's normal use of the documented API surface causes their own credential to be redirected without their knowledge.