panrouter

{"modified":"2026-06-18T17:10:57Z","published":"2026-06-18T16:28:27Z","schema_version":"1.7.4","id":"MAL-2026-6133","summary":"Malicious code in panrouter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9fd8aaf176011a764d660ee547645c34815e959d39087519cd187c1ac1af2d53)\npanrouter is advertised as a 'Claude Code router' but on default invocation (`panrouter` with no arguments) it (a) installs and rewrites the user's Claude Code configuration so that ANTHROPIC_BASE_URL points at a local proxy, and (b) launches a detached Node process running relay_client.cjs that opens a persistent WebSocket to wss://jiuling.xyz/ws. The relay registers the host using hostname+pid as nodeId and processes inbound JSON messages: any message containing a `command` field is passed verbatim to child_process.execSync with operator-supplied cwd and timeout, giving the operator of jiuling.xyz a fully-controlled remote shell on every installer's machine. The relay maintains itself via exponential-backoff reconnect and a 45s heartbeat watchdog. On Windows, the shipped tray-daemon.ps1 adds an HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry named 'PanRouter' for autostart and respawns relay_client.cjs every 5 seconds if missing, ensuring persistence across reboots. Independently, server.mjs and relay_client.cjs hardcode all Claude Code requests to be forwarded to https://opencode.ai/zen/v1/chat/completions with Authorization: 'Bearer public', remapping any user-selected model to 'deepseek-v4-flash-free'. cli.mjs writeConfig() overwrites ~/.claude/settings.json so that ANTHROPIC_BASE_URL=http://127.0.0.1:50816 and ANTHROPIC_AUTH_TOKEN=public, causing all Claude prompts the user issues — which routinely contain source code and secrets — to be silently routed through opencode.ai under a shared anonymous 'public' identity rather than the user's own Anthropic account.\n","affected":[{"package":{"ecosystem":"npm","name":"panrouter"},"versions":["5.0.1","5.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"relay_client.cjs","sha256":"605f82ca9a5ba88ab29eef42a2ea41af4d7f32237d37057773bca7012cc26174","tlsh":"e862c66c54fa15213377f27c2a472056722af007314ada91768c36586fec73886f6bbe"},{"path":"cli.mjs","sha256":"511521dbfcd963e646ae0dbf55ab0d7d442d60a09a8a2fe9fc48029a22a83bb6","tlsh":"c632946a51bf4f3344b79a795307601632aac2137284edbc77dcc9422f8e238857d28c"},{"path":"server.mjs","sha256":"8f3fcc082a91eedab669b6f56c9d8be01bd9966272f520bf73c2a633695779eb","tlsh":"4e7298b414f3341577abe26c2e4b2069b279b0177206d991f24cf5686fdc53482babbc"}],"package_integrity":[{"filename":"panrouter-5.0.1.tgz","hashes":{"sha1":"f3acc6c7ec6a6d36c387fa989196fcc6fccf30fa","sha512_sri":"sha512-y9rvLTe14v8JjP6eDoe7SpH7TkI8nBy5f90yPavlkCt9wyhGuc04dTLY3QI099jtkDeDp6lYWtmDSq7tS2pEgA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/panrouter/v/5.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/panrouter/v/5.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007004","import_time":"2026-06-18T17:08:47.680352664Z","modified_time":"2026-06-18T16:28:27Z","sha256":"9fd8aaf176011a764d660ee547645c34815e959d39087519cd187c1ac1af2d53","source":"amazon-inspector","versions":["5.0.1"]},{"id":"IN-MAL-2026-007006","import_time":"2026-06-18T17:08:47.851195588Z","modified_time":"2026-06-18T16:28:29Z","sha256":"b51d00edd7a37d5352fecfc7210f281898bec61d219653df464a2ae70404e21d","source":"amazon-inspector","versions":["5.0.0"]}]}}