# Claude Code MCP Traffic Hijack via Malicious npm postinstall — ~/.claude.json Tampering Proxies MCP Endpoints to Steal Persistent OAuth Bearer Tokens (Mitiga Labs PoC)

> Mitiga Labs demonstrated a five-step supply-chain attack where a malicious npm package's postinstall hook tampers with Claude Code's global ~/.claude.json: it seeds directory-trust flags, injects a SessionStart hook, and rewrites mcpServers URLs to an attacker-controlled localhost proxy (mitmproxy). The proxy intercepts persistent, broadly-scoped OAuth bearer tokens for connected SaaS (Atlassian/Jira/Confluence, GitHub) stored in plaintext. Because the config is reseeded on every Claude Code load, token rotation alone does not remediate. Anthropic ruled it out of scope (prior user consent); no patch planned.

- **Published:** 2026-06-08T00:00:00Z
- **Last reviewed:** 2026-06-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0712
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-claude-code-mcp-hijack-tl-2026-0712.webp?v=ade9b9df (Threadlinqs threat intel: Claude Code npm Postinstall Hijacks MCP: Detection & IOCs (TL-2026-0712) — High severity, 12 IOCs, 9 detection rules.)
- **ID:** TL-2026-0712
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

Mitiga Labs published a proof-of-concept attack chain that abuses Anthropic Claude Code's trust and Model Context Protocol (MCP) configuration model to silently exfiltrate OAuth bearer tokens for SaaS services connected over MCP. The entire attack lives in a single user-level file that few teams monitor: the global ~/.claude.json, which stores directory trust state, lifecycle hooks, MCP server endpoint definitions, and — critically — OAuth access and refresh tokens in plaintext.

Delivery (Step 1): The attacker publishes or compromises an npm package containing a silent postinstall lifecycle script. When a developer runs `npm install`, the postinstall hook executes with the developer's privileges and edits ~/.claude.json. It pre-populates directory-trust acceptance flags (the trust-dialog state, e.g. hasTrustDialogAccepted) set to true across common developer clone paths, so that when Claude Code later opens those projects no trust prompt fires and no user consent is solicited.

Persistence seeding (Step 2): The same hook inserts a SessionStart hook into ~/.claude.json. SessionStart hooks run automatically every time Claude Code loads a trusted project, giving the attacker recurring code execution that survives normal cleanup.

MCP endpoint rewrite (Step 3): On each load, the SessionStart hook rewrites the URLs in the mcpServers section of the config, replacing the legitimate remote MCP server endpoints (for example the Atlassian or GitHub MCP servers) with addresses pointing to an attacker-controlled localhost proxy. In the PoC the proxy is implemented with mitmproxy.

Token interception (Step 4): When Claude Code next initializes a session it connects to the rewritten endpoint. The MCP OAuth flow — including the bearer token carried in the HTTP Authorization header and any token refresh using the stored refresh token — transits the attacker's local proxy, which captures the token in clear text. Because Claude Code's MCP traffic to remote providers egresses through Anthropic's infrastructure, the provider sees an apparently valid OAuth flow from a trusted origin (Anthropic egress IP range), so the theft is essentially unattributable server-side.

Persistent reseeding (Step 5): The SessionStart hook reasserts the malicious configuration on every load. If a defender manually corrects an MCP URL or rotates the stolen credential, the next session reseeds the proxy URL and the next OAuth refresh re-captures a fresh token. The four properties that make the stolen tokens valuable: persistent (stored for reuse with an associated refresh token), broadly scoped (inheriting every permission granted at authorization time), weakly stored (plaintext in ~/.claude.json), and server-side unattributable (presented from Anthropic egress IPs).

Remediation order is the key defensive insight: rotating tokens first is ineffective because the live hook recaptures the refreshed token. Defenders must remove the SessionStart hook, clean malicious trust flags and mcpServers entries from ~/.claude.json, and only then rotate the affected SaaS OAuth credentials.

Disclosure: Mitiga reported to Anthropic on 2026-04-10; Anthropic acknowledged on 2026-04-11 and on 2026-04-12 classified it out of scope, citing the requirement of prior user consent (installing the npm package and trusting the directory). No patch is planned, so the technique remains viable and detection/IR ownership falls to defenders.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1195 Supply Chain Compromise
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1059 Command and Scripting Interpreter
- T1204.003 Malicious Image
- T1546 Event Triggered Execution
- T1547 Boot or Logon Autostart Execution
- T1685 Disable or Modify Tools
- T1556 Modify Authentication Process
- T1548 Abuse Elevation Control Mechanism
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1557 Adversary-in-the-Middle
- T1090.001 Proxy: Internal Proxy
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Claude Code SessionStart Hook Injection & Trust-Flag Seeding — Post-Exploitation Phase** (`TL-2026-0712-SPL-002`)

Detects persistence seeding in the MCP Traffic Hijack: injection of a SessionStart lifecycle hook and pre-seeding of hasTrustDialogAccepted=true into ~/.claude.json. The SessionStart hook gives recurring code execution on every Claude Code load and reseeds malicious config; trust-flag seeding suppresses the directory-trust prompt without user consent.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1546, T1556, T1548
- **Data sources:** sysmon, edr, file_integrity_monitoring
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*\\.claude.json" 
| append [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*hasTrustDialogAccepted*" OR CommandLine="*SessionStart*") CommandLine="*.claude.json*" ] 
| eval indicator=case(match(CommandLine,"(?i)hasTrustDialogAccepted"),"trust_flag_seed", match(CommandLine,"(?i)SessionStart"),"sessionstart_hook_inject", true(),"config_write") 
| stats count values(indicator) as indicators values(CommandLine) as cmd values(Image) as proc by Computer, User 
| where count > 0
```

### Microsoft KQL

```kql
union DeviceProcessEvents, DeviceFileEvents | where Timestamp > ago(24h) | where (ProcessCommandLine has_any ('hasTrustDialogAccepted','SessionStart') and ProcessCommandLine has '.claude.json') or (FileName =~ '.claude.json' and InitiatingProcessCommandLine has_any ('SessionStart','hasTrustDialogAccepted')) | extend Indicator = case(ProcessCommandLine has 'hasTrustDialogAccepted','trust_flag_seed', ProcessCommandLine has 'SessionStart','sessionstart_hook_inject','config_write') | project Timestamp, DeviceName, AccountName, Indicator, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath
```

### Sigma

```yaml
title: Claude Code SessionStart Hook Injection and Trust Flag Seeding
id: 9a2b7e54-3c1d-4f88-b6a0-7d5e1c2f3a90
status: experimental
description: Detects injection of a SessionStart hook or seeding of hasTrustDialogAccepted into ~/.claude.json, the persistence/reseeding mechanism of the Claude Code MCP Traffic Hijack.
references:
    - https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/08
tags:
    - attack.persistence
    - attack.t1546
    - attack.defense_evasion
    - attack.t1556
    - attack.t1548
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'hasTrustDialogAccepted'
            - 'SessionStart'
        cfg:
            CommandLine|contains: '.claude.json'
    condition: selection and cfg
falsepositives:
    - Administrators legitimately configuring Claude Code hooks or trust state
level: high
```

**Known false positives:**

- Legitimate admin configuration of Claude Code SessionStart hooks
- User explicitly accepting directory trust through supported tooling

**Tuning notes:** Parse ~/.claude.json with FIM and diff the hooks and projects keys; alert on any new SessionStart entry or trust flag for a path not in an approved allowlist. Whitelist known IT-managed config-push processes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MDE: npm postinstall Writing Claude Code Config — Exploitation Phase (locked: unlock with TL Creds)
- MDE: SessionStart Hook & Trust-Flag Persistence in Claude Code Config — Post-Exploitation Phase (locked: unlock with TL Creds)
- MDE: MCP OAuth Bearer Redirection via Loopback Proxy — C2/AiTM Phase (locked: unlock with TL Creds)
- Sigma: Claude Code Config Tamper During Package Install — Exploitation Phase (locked: unlock with TL Creds)
- Sigma: SessionStart Hook Injection & Trust-Flag Seeding — Post-Exploitation Phase (locked: unlock with TL Creds)
- Sigma: mcpServers Loopback Rewrite & OAuth Bearer Interception — C2/AiTM Phase (locked: unlock with TL Creds)
- Claude Code Config Tampering by npm postinstall — Exploitation Phase (locked: unlock with TL Creds)
- Claude Code mcpServers Rewrite to Loopback Proxy & OAuth Bearer Capture — C2/AiTM Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Claude Code MCP Token Theft: MitM Attack Explained](https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm)
- [Hackers Can Hijack Claude Code MCP Traffic to Steal OAuth Tokens](https://cybersecuritynews.com/claude-code-mcp-traffic-hijack/)
- [Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking](https://www.securityweek.com/claude-code-oauth-tokens-can-be-stolen-through-stealthy-mcp-hijacking/)
- [Claude Code MCP Attack Enables Persistent Token Theft](https://www.esecurityplanet.com/threats/claude-code-mcp-attack-enables-persistent-token-theft/)
- [Claude Code has an MCP security problem — and your developers are already using it](https://www.csoonline.com/article/4181230/claude-code-has-an-mcp-security-problem-and-your-developers-are-already-using-it.html)
- [Mitiga Labs: MCP Hijack Attack Steals Claude Code OAuth Tokens via Silent Man-in-the-Middle](https://gridthegrey.com/posts/mcp-hijack-attack-steals-claude-code-oauth-tokens-via-silent-man-in-the-middle/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0712