Claude Code MCP Traffic Hijack via Malicious npm postinstall — ~/.claude.json Tampering Proxies MCP Endpoints to Steal Persistent OAuth Bearer Tokens (Mitiga Labs PoC)
Claude Code MCP Traffic Hijack via Malicious npm postinstall (TL-2026-0712), also tracked as Claude Code MCP Traffic Hijack, is a high-severity supply-chain compromise, first published 2026-06-08. It has no confirmed attribution, affects Anthropic Claude Code, maps to 15 MITRE ATT&CK techniques (T1041, T1059, T1090.001), and is covered by 9 detection rules and 12 indicators of compromise.
Key facts for TL-2026-0712
- Threat ID
- TL-2026-0712
- Also known as
- Claude Code MCP Traffic Hijack, MCP Hijack OAuth Token Theft, Claude Code MCP MitM
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-08
- Last reviewed
- 2026-06-08
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, devops, saas
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Claude Code MCP Traffic Hijack via Malicious npm postinstall
Malware and tooling: Attacker-controlled localhost HTTP(S) intercepting proxy, mitmproxy
Mitiga Labs demonstrated a five-step supply-chain attack where a malicious npm package's postinstall hook tampers with Claude Code's global ~/.claude.json: it seeds directory-trust flags, injects a SessionStart hook, and rewrites mcpServers URLs to an attacker-controlled localhost proxy (mitmproxy). The proxy intercepts persistent, broadly-scoped OAuth bearer tokens for connected SaaS (Atlassian/Jira/Confluence, GitHub) stored in plaintext. Because the config is reseeded on every Claude Code load, token rotation alone does not remediate. Anthropic ruled it out of scope (prior user consent); no patch planned.
How Claude Code MCP Traffic Hijack via Malicious npm postinstall works
Mitiga Labs published a proof-of-concept attack chain that abuses Anthropic Claude Code's trust and Model Context Protocol (MCP) configuration model to silently exfiltrate OAuth bearer tokens for SaaS services connected over MCP. The entire attack lives in a single user-level file that few teams monitor: the global ~/.claude.json, which stores directory trust state, lifecycle hooks, MCP server endpoint definitions, and — critically — OAuth access and refresh tokens in plaintext.
Delivery (Step 1): The attacker publishes or compromises an npm package containing a silent postinstall lifecycle script. When a developer runs `npm install`, the postinstall hook executes with the developer's privileges and edits ~/.claude.json. It pre-populates directory-trust acceptance flags (the trust-dialog state, e.g. hasTrustDialogAccepted) set to true across common developer clone paths, so that when Claude Code later opens those projects no trust prompt fires and no user consent is solicited.
Persistence seeding (Step 2): The same hook inserts a SessionStart hook into ~/.claude.json. SessionStart hooks run automatically every time Claude Code loads a trusted project, giving the attacker recurring code execution that survives normal cleanup.
MCP endpoint rewrite (Step 3): On each load, the SessionStart hook rewrites the URLs in the mcpServers section of the config, replacing the legitimate remote MCP server endpoints (for example the Atlassian or GitHub MCP servers) with addresses pointing to an attacker-controlled localhost proxy. In the PoC the proxy is implemented with mitmproxy.
Token interception (Step 4): When Claude Code next initializes a session it connects to the rewritten endpoint. The MCP OAuth flow — including the bearer token carried in the HTTP Authorization header and any token refresh using the stored refresh token — transits the attacker's local proxy, which captures the token in clear text. Because Claude Code's MCP traffic to remote providers egresses through Anthropic's infrastructure, the provider sees an apparently valid OAuth flow from a trusted origin (Anthropic egress IP range), so the theft is essentially unattributable server-side.
Persistent reseeding (Step 5): The SessionStart hook reasserts the malicious configuration on every load. If a defender manually corrects an MCP URL or rotates the stolen credential, the next session reseeds the proxy URL and the next OAuth refresh re-captures a fresh token. The four properties that make the stolen tokens valuable: persistent (stored for reuse with an associated refresh token), broadly scoped (inheriting every permission granted at authorization time), weakly stored (plaintext in ~/.claude.json), and server-side unattributable (presented from Anthropic egress IPs).
Remediation order is the key defensive insight: rotating tokens first is ineffective because the live hook recaptures the refreshed token. Defenders must remove the SessionStart hook, clean malicious trust flags and mcpServers entries from ~/.claude.json, and only then rotate the affected SaaS OAuth credentials.
Disclosure: Mitiga reported to Anthropic on 2026-04-10; Anthropic acknowledged on 2026-04-11 and on 2026-04-12 classified it out of scope, citing the requirement of prior user consent (installing the npm package and trusting the directory). No patch is planned, so the technique remains viable and detection/IR ownership falls to defenders.
MITRE ATT&CK techniques used in TL-2026-0712
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204.003 Malicious Image
Command and Control
T1090.001 Proxy: Internal Proxy
initial-access
Initial Access
T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1557 Adversary-in-the-Middle
Persistence
T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
privilege-escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
T1556 Modify Authentication Process; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in Claude Code MCP Traffic Hijack via Malicious npm postinstall
- Anthropic — Claude Code
Vulnerable versions: all versions storing OAuth tokens in plaintext ~/.claude.json with user-writable trust flags and SessionStart hooks
Fixed in: none — out of scope, no patch planned - Atlassian — Jira / Confluence (MCP OAuth connection)
Vulnerable versions: MCP-connected via Claude Code OAuth - GitHub — GitHub (MCP OAuth connection)
Vulnerable versions: MCP-connected via Claude Code OAuth
Remediation for Claude Code MCP Traffic Hijack via Malicious npm postinstall
Patches
- No vendor patch available — Anthropic classified the report out of scope on 2026-04-12 and stated no patch is planned
Immediate actions
- Remove any attacker-injected SessionStart hook from ~/.claude.json BEFORE rotating any credentials
- Inspect and clean the mcpServers section of ~/.claude.json — restore legitimate remote MCP endpoint URLs and remove any localhost/proxy URLs
- Audit directory trust flags (e.g. hasTrustDialogAccepted) in ~/.claude.json and revoke trust for paths the user did not explicitly approve
- Only AFTER the hook and config are cleaned, rotate/revoke OAuth tokens and refresh tokens for all MCP-connected SaaS (Atlassian/Jira/Confluence, GitHub)
Workarounds
- Disable npm lifecycle scripts (npm config set ignore-scripts true) for untrusted installs
- Pin and review MCP server URLs; alert on any change to mcpServers entries or new local proxy listeners
- Store MCP OAuth credentials in an OS keychain rather than relying on Claude Code plaintext storage where supported
Longer-term hardening
- Treat ~/.claude.json as a sensitive secret store; restrict permissions and monitor it with file integrity monitoring (FIM)
- Run npm install with --ignore-scripts in CI and on developer machines where feasible to neutralize postinstall hooks
- Vet npm dependencies and lockfiles; use allowlists and scoped registries for AI-tooling dependencies
- Prefer short-lived, narrowly-scoped OAuth grants for MCP connections; avoid broad scopes and long-lived refresh tokens where the provider allows
- Educate developers that directory trust prompts and MCP endpoint URLs are security boundaries
Weaknesses (CWE) in Claude Code MCP Traffic Hijack via Malicious npm postinstall
CWE-522, CWE-312, CWE-494, CWE-829, CWE-668
Timeline of Claude Code MCP Traffic Hijack via Malicious npm postinstall
- Mitiga Labs reported the MCP traffic hijack / OAuth token theft technique to Anthropic.
- Anthropic acknowledged receipt of the Mitiga report.
- Anthropic classified the report out of scope, citing prior user consent (package install + directory trust); stated no patch is planned.
- Threadlinqs Intelligence ingested the threat as TL-2026-0712 (SUPPLY_CHAIN, HIGH) and initiated detection and simulation development.
- Mitiga Labs publicly disclosed the five-step attack chain with a proof-of-concept using mitmproxy; covered by Cyber Security News, SecurityWeek, eSecurity Planet, and CSO Online.
Sources cited for Claude Code MCP Traffic Hijack via Malicious npm postinstall
- Claude Code MCP Token Theft: MitM Attack Explained
- Hackers Can Hijack Claude Code MCP Traffic to Steal OAuth Tokens
- Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking
- Claude Code MCP Attack Enables Persistent Token Theft
- Claude Code has an MCP security problem — and your developers are already using it
- Mitiga Labs: MCP Hijack Attack Steals Claude Code OAuth Tokens via Silent Man-in-the-Middle
Threats related to Claude Code MCP Traffic Hijack via Malicious npm postinstall
Detection coverage for TL-2026-0712
As of 2026-06-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0712 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.