altis-claude-harness — an internal Claude Code harness that captures your full prompts, responses and machine identity
The npm package altis-claude-harness is an internal developer harness for Claude Code (Altis Sistemas). It is a legitimate tool, not malware — but it is privacy-heavy: on every Claude Code stop it beams your full prompt and the assistant's full response, together with your machine's MAC address and a matched employee id, to a telemetry endpoint, and the published package ships hardcoded internal API credentials. The destination is the organisation's own private-LAN server, not a third-party host, and the telemetry is disableable — hence risky, not malicious.
altis-claude-harness is an internal standards/harness package for Claude Code published to npm by Altis Sistemas (Brazil). It ships coding agents, hooks and rules, per-workstation licensing via a hardware/MAC fingerprint, and transcript telemetry. There is no install-time hook (no postinstall), and no eval/base64-exec anywhere — it is ordinary tooling, not a stealth payload.
Full prompt + response capture. On a Claude Code Stop/SubagentStop the harness parses the session transcript and POSTs a JSON record containing the complete user prompt text and assistant response (truncated to ~200k), the model name, token counts, session id, working directory, hostname, the workstation's MAC address, and a matched employee id. A developer's prompts and the model's answers routinely contain source code, secrets and business context — so this is a broad data-capture surface, even when kept in-house.
Hardcoded internal credentials in the published package. The published tarball ships hardcoded internal API keys for the telemetry/RAG backends. Credentials committed into a public npm package are a credential-hygiene failure and should be rotated and removed, regardless of whether the endpoints are internal.
Machine-fingerprint licensing. Per-station licensing keys off the hardware/MAC fingerprint — expected for a corporate tool, but part of the identity-capture surface.
This is not malware. The telemetry destination is the organisation's own self-hosted server on a private LAN (RFC1918 address read from the user's own config), not a hardcoded third-party host — so there is no covert third-party exfiltration. There is no reverse shell, no remote-fetch-and-execute dropper, and no credential theft from the user's machine. The capture is disableable (ALTIS_CLAUDE_TELEMETRIA=0), and self-update pulls the same package from public npm. codelake's “risky” rating reflects privacy-heavy data capture plus a credential-hygiene failure in a legitimate tool — the risk falls on the tool's own users and publisher, not on third parties.
Observed in 1.12.0 (the telemetry + licensing behaviour is the tool's declared design, not a single-version change).
[email protected] and rates it a risky tool (privacy-heavy telemetry + hardcoded internal credentials in the published package). Not malware.ALTIS_CLAUDE_TELEMETRIA=0; self-update pulls the same package from public npmcodelake risky-tool classification (security-hygiene / privacy observation, not a malware finding). Verified by static code review of the published npm tarball (1.12.0); no execution. Destination is the publisher's own private-LAN backend; no third-party exfiltration, reverse shell, or dropper found.