What's Happening?
Researchers at Mitiga Labs have identified a significant security vulnerability in Claude Code, a tool used by developers. The vulnerability involves a malicious npm package that appears legitimate but contains a hidden post-install hook. This hook silently
alters the ~/.claude.json file, which controls how Claude Code routes MCP traffic. By changing this file, attackers can redirect authenticated requests to their own infrastructure, intercepting OAuth tokens in transit. These tokens, which are valid and long-lived, can be used to access various SaaS platforms like Jira, Confluence, and GitHub. The attack is difficult to detect because audit logs show legitimate IP addresses and valid sessions, masking the unauthorized access. Mitiga reported the issue to Anthropic, the company behind Claude Code, on April 10. However, Anthropic deemed the issue out of scope, as it requires prior code execution through user-consented package installation. As of now, no patch has been released, and the attack chain remains active.
Why It's Important?
This vulnerability poses a significant risk to developers and organizations using Claude Code, as it allows attackers to gain unauthorized access to sensitive platforms and data. The interception of OAuth tokens can lead to data breaches, unauthorized data manipulation, and potential financial losses. Organizations relying on Claude Code for development processes may face increased security threats, necessitating enhanced monitoring and security measures. The incident highlights the importance of scrutinizing third-party packages and the need for robust security protocols to prevent such vulnerabilities. The lack of a patch from Anthropic further exacerbates the risk, leaving developers vulnerable to ongoing attacks.
What's Next?
Organizations using Claude Code should immediately implement monitoring for unexpected changes in the ~/.claude.json file, particularly for new localhost proxy addresses or unfamiliar endpoints. Security teams need to enhance their detection capabilities for user-level configuration files in developer environments. Mitiga recommends tracking changes to Claude Code configuration, MCP server URLs, and OAuth refresh behavior as primary detection layers. Until a patch is released, developers must exercise caution with npm packages and consider alternative security measures to protect their systems from potential exploitation.
