npm

@anthropic-ai/claude-code

28 Total advisories

28 Vulnerabilities

0 Malware

Dependency scanning

Check whether @anthropic-ai/claude-code is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

@anthropic-ai/claude-code

Vulnerabilities

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution

Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

Claude Code has Permission Deny Bypass Through Symbolic Links

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions

Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes

Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains

Claude Code has a Command Injection in find Command Bypasses User Approval Prompt

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

Claude Code vulnerable to command execution prior to startup trust dialog

Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

Claude Code permission deny bypass through symlink

Claude Code can execute commands prior to the startup trust dialog

Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email

Claude Code rg vulnerability does not protect against approval prompt bypass

Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning

Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code

Claude Code echo command allowed bypass of user approval prompt for command execution

Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Claude Code Improper Authorization via websocket connections from arbitrary origins

Browse more npm advisories

Start Securing