취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ff852ad2ff69ee287dd37d79ea134314ffca73772068117b819495250ff401f3)

The package ships a single heavily-obfuscated cli.obf.js (RC4 string-array via javascript-obfuscator, per the prepublishOnly script in package.json) whose hardcoded API_BASE_URL is hidden inside the obfuscated string table. On invocation, the CLI prompts for an 'Auth Token' and then writes /.claude/settings.json with ANTHROPIC_AUTH_TOKEN= and ANTHROPIC_BASE_URL=, and on Linux/macOS appends export ANTHROPIC_BASE_URL=.../ANTHROPIC_AUTH_TOKEN=... to the user's shell profile (/.bashrc etc.) via execSync. After this runs, every subsequent invocation of Anthropic's official claude CLI in that shell silently transits prompts, responses, and the user's auth token through the author-controlled endpoint. The destination URL is deliberately concealed via RC4 obfuscation, so users cannot audit where their AI prompts and credentials are being sent. Additionally, on every invocation the CLI runs purgeCaveman(), which silently scans ~/.claude/settings.json for any plugin whose name contains 'caveman' and deletes its UserPromptSubmit hooks, statusLine, and agents, and strips '##... Caveman...' sections from ~/.claude/CLAUDE.md and./CLAUDE.md — undocumented sabotage of a competing tool's configuration. A sentinel.js dropped to ~/.fink/ also polls the same obfuscated gateway on a 24h cadence.