This repository documents critical security vulnerabilities discovered in the claude-flow npm package.
Disclosure Date: 2026-01-24 Package: claude-flow Claimed Downloads: ~500,000 Severity: Critical
The claude-flow npm package contains multiple supply chain attack vulnerabilities that enable:
- Remote injection of behavioral patterns into Claude instances
- Access to complete conversation histories via session file reading
- Fake cryptographic verification (checks string length, not actual signatures)
- Silent execution of arbitrary code on every Claude operation
| ID | Vulnerability | Severity | Location |
|---|---|---|---|
| CF-001 | Fake Ed25519 signature verification | Critical | registry.ts:285, discovery.ts:402, download.ts:314 |
| CF-002 | Hardcoded trusted IPNS bootstrap keys | High | registry.ts:24-41 |
| CF-003 | Fabricated CIDs on network failure | High | discovery.ts:228-237 |
| CF-004 | Hardcoded fallback payload | High | discovery.ts:318-389 |
| CF-005 | Claude session file access | High | claude-telemetry.js:16-20 |
| CF-006 | Silent automatic hook execution | High | .claude/settings.json |
| CF-007 | OpenTelemetry exfiltration vector | Medium | claude-telemetry.js:93-98 |
- Remove
claude-flowfrom all projects - Audit any
.claude/settings.jsonfiles for suspicious hooks - Check if session data was accessed
- Block IPFS gateway domains if not explicitly needed
# Terminate running processes
pkill -f claude-flow
# Remove config entries
# Edit ~/.claude/settings.json and remove claude-flow hooks
# Delete artifacts
rm -rf ~/.claude-flowFull Remediation Guide: https://maat.is/report.html
- SECURITY-REPORT.md - Full technical security report
- IMPACT-SCENARIOS.md - Catastrophic attack scenarios and real-world impact
- TIMELINE.md - Git commit history analysis
- EVIDENCE.md - Code snippets and proof
This vulnerability has been formally documented in a peer-archived research paper:
Cognitive Supply Chain Compromise: An Exhaustive Forensic Analysis of the claude-flow and agentic-flow Behavioral Injection Vulnerabilities
- Author: Chenoweth, Christopher
- DOI: 10.5281/zenodo.18356733
- Date: January 24, 2026
Files:
- Original Disclosure: https://maat.is/security-disclosure.html
- Remediation Guide: https://maat.is/report.html
- Code Mirror: https://g.8b.is/gitlove/claude-flow/
- Zenodo Archive: https://zenodo.org/records/18356733
- Deep Dive: https://gemini.google.com/share/7be25eb36f11
- npm Security: https://www.npmjs.com/advisories/report
- GitHub Security: https://github.com/security/advisories/new
- Anthropic: security@anthropic.com
This security research is provided for defensive purposes under responsible disclosure principles.