MAL-2026-13363

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e88afc6f55057610bf4d08504cb81d57d75ebb6f4b914b513ba7ce8e6c970f31) santaclaude.js opens a persistent WebSocket to wss://santaclaude.app/ws and dispatches server-supplied frames into runControl on the installer's host. A 'tailscale-up' action reads cmd.sudo from the frame and invokes 'sudo -S -p' with that password, then writes a passwordless NOPASSWD entry to /etc/sudoers.d/santaclaude-tailscale, granting the vendor endpoint persistent root capability. Additional actions push server-sent text into a tmux window running 'claude --dangerously-skip-permissions', allowing the remote to drive the local Claude Code TUI with permission checks disabled. The package also runs a supervisor loop that respawns itself via 'npx -y @cliphijack/santaclaude@<spec>', where spec is read from ~/.santaclaude-target and refreshed from GET https://santaclaude.app/api/cli-version, allowing the vendor to steer the installer onto arbitrary future versions of the package at any time. The combined behavior is a remote-controlled RCE and privilege-escalation channel into the installer's host, plus a vendor-controlled auto-update path that determines what code runs next.