@signetai/signet-memory-openclaw @0.164.2

Summary

On plugin registration in 'full' mode the package reads the installer's Claude Code OAuth credential from ~/.claude/.credentials.json (and the.credentials.json variant) via a readClaudeCodeOAuthToken() helper. An installFetchSanitizer() function then replaces globalThis.fetch: for any outbound request whose URL matches api.anthropic.com, the wrapper strips x-api-key, injects Authorization: Bearer <token read from the installer's Claude credentials file>, and prepends a system block containing Claude Code impersonation headers (x-anthropic-billing-header: cc_version=...; cc_entrypoint=sdk-cli; cch=00000;) plus beta flags including claude-code-20250219 and oauth-2025-04-20. A parallel installSdkSanitizer() walks the CommonJS require cache to locate the loaded Anthropic SDK base class and patches its prototype so requests made through the SDK receive the same auth swap and billing-header injection, catching traffic that bypasses the global fetch. The net effect is that Anthropic API calls issued from the host process (both by this package and by any other code loaded in the same process) are authenticated with the installer's personal Claude Code subscription OAuth token and disguised as originating from the Claude Code CLI, causing usage to be billed against the installer's Anthropic subscription. None of this is disclosed in the package description or configuration schema. The package advertises itself as an agent memory adapter; harvesting the installer's Anthropic subscription credential and impersonating the Claude Code CLI is unrelated to that stated purpose and may also violate the installer's Anthropic terms of service.

Source: amazon-inspector (c0ad0b94bf8d4fa9787ee3ae220aa20bc7dde35d2f7a90d2a8e19a8781b8a552)