xerj-code

This is a benchmark automation script, not evident malware: it clones repositories from github[.]com, optionally indexes repository contents through the configurable Xerj endpoint (default http://localhost:9200), and invokes Claude to create patches. The principal security risk is running the agent with --permission-mode bypassPermissions in a repository containing potentially adversarial instructions, with subprocesses inheriting the caller's environment. A remotely configured Xerj endpoint may receive repository content; no specific credentials, secrets, or external exfiltration destination are identified. Severity is moderate and depends on execution privileges, repository trust, and endpoint configuration.