@agentai2027/openclaw-zh@2026.7.1-2-zh: Suspicious npm security

Loading npm security reports…

@agentai2027/openclaw-zh@2026.7.1-2-zh: Suspicious npm security | LPM Firewall

Source & flagged code

21 flagged

Lines 1750-1790json

1750 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1751 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1752 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1753 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1754 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1755 "plugin-sdk:surface": "node --max-old-space-size=8192 scripts/plugin-sdk-surface-report.mjs",

1756 "plugin-sdk:surface:check": "node --max-old-space-size=8192 scripts/plugin-sdk-surface-report.mjs --check",

1757 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1758 "plugin-sdk:usage": "node --max-old-space-size=8192 --import tsx scripts/analyze-plugin-sdk-usage.ts",

1759 "policy:config-coverage": "node --import tsx scripts/check-policy-config-coverage.ts",

1760 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1761 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1762 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1763 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1764 "plugins:assets:build": "node scripts/bundled-plugin-assets.mjs --phase build",

1765 "plugins:assets:copy": "node scripts/bundled-plugin-assets.mjs --phase copy",

1766 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1767 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1768 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1769 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1770 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1770

1771 "postpack": "node scripts/package-changelog.mjs restore",

1772 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

1773 "prepack": "node --import tsx scripts/openclaw-prepack.ts",

1774 "prepare": "node scripts/prepare-git-hooks.mjs",

1775 "prepush:ci": "bash scripts/prepush-ci.sh",

1776 "probe:anthropic:prompt": "node --import tsx scripts/anthropic-prompt-probe.ts",

1777 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1778 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1779 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1780 "protocol:check": "pnpm protocol:gen && pnpm protocol:gen:swift && pnpm protocol:gen:kotlin && git diff --exit-code -- dist/protocol.schema.json apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewayProtocol.kt apps/android/app/src/main/java/ai/openclaw/app/protocol/OpenClawProtocolConstants.kt",

1781 "protocol:check:kotlin": "pnpm protocol:gen:kotlin && git diff --exit-code -- apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewayProtocol.kt apps/android/app/src/main/java/ai/openclaw/app/protocol/OpenClawProtocolConstants.kt",

1782 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1783 "protocol:gen:kotlin": "node --import tsx scripts/protocol-gen-kotlin.ts",

1784 "protocol:gen:swift": "node --import tsx scripts/protocol-gen-swift.ts",

1785 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1786 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1787 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1788 "proxy:run": "node scripts/run-node.mjs proxy run",

1789 "proxy:start": "node scripts/run-node.mjs proxy start",

1790 "qa:e2e": "node --import tsx scripts/qa-e2e.ts",

dist/dist-BljnBpL7.jsView file

5591patternName = private_key_rsa severity = critical line = 5591 matchedText = if (type...g");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/dist-BljnBpL7.jsView on unpkg · L5591

5591patternName = private_key_rsa severity = critical line = 5591 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/dist-BljnBpL7.js

dist/dist-BljnBpL7.jsView on unpkg · L5591

13350patternName = generic_password severity = medium line = 13350 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-BljnBpL7.js

dist/dist-BljnBpL7.jsView on unpkg · L13350

dist/channel.runtime-BFLIodGi.jsView file

28import "./channel-outbound-iiIHtgEr.js"; L29: import { u as [redacted] } from "./ssrf-policy-BUea-i3n.js"; L30: import "./ssrf-runtime-C-mldm7c.js"; ... L39: import { t as tlonSetupWizard } from "./setup-surface-Dy4jLjpF.js"; L40: import { $n as translateTraits, An as getValueFromTextNode, Bn as decorateServiceException, Cn as isArrayBuffer, Cr as require_dist_cjs$16, Ct as resolveDefaultsModeConfig, Dn as m... L41: import { env, versions } from "node:process"; ... L293: //#region extensions/tlon/src/urbit/fetch.ts L294: async function urbitFetch(params) { L295: const validated = validateUrbitBaseUrl(params.baseUrl); ... L318: headers: { "Content-Type": "application/x-www-form-urlencoded" }, L319: body: new URLSearchParams({ password: code }).toString() L320: },

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/channel.runtime-BFLIodGi.jsView on unpkg · L28

4430async loadEventStreamCapability() { L4431: const { EventStreamSerde, eventStreamSerdeProvider } = await import("./event-streams-xeqAkkiV.js"); L4432: return new EventStreamSerde({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channel.runtime-BFLIodGi.jsView on unpkg · L4430

dist/control-ui/assets/config-runtime-BxOat2Bj.jsView file

Lines 1-25javascript

1import{n as e}from"./rolldown-runtime-DaJ6WEGw.js";function t(e,n,r){let i=e[n];if(typeof i==`object`&&

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 5654 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

dist/control-ui/assets/stex-_geSQI7Q.js.brView file

•path = dist/control-ui/assets/stex-_geSQI7Q.js.br kind = compressed_blob sizeBytes = 1176 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/control-ui/assets/stex-_geSQI7Q.js.brView on unpkg

dist/control-ui/assets/idl-CF0Vc8u9.js.brView file

•path = dist/control-ui/assets/idl-CF0Vc8u9.js.br kind = high_entropy_blob sizeBytes = 4354 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/control-ui/assets/idl-CF0Vc8u9.js.brView on unpkg

dist/runtime-api-DYUsZxvV.jsView file

•path = dist/runtime-api-DYUsZxvV.js kind = oversized_source_file sizeBytes = 2423753 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/runtime-api-DYUsZxvV.jsView on unpkg

dist/proxy-cli.runtime-0EabOY8s.jsView file

865patternName = generic_password severity = medium line = 865 matchedText = url.pass...ed";

Medium

Secret Pattern

Hardcoded password in dist/proxy-cli.runtime-0EabOY8s.js

dist/proxy-cli.runtime-0EabOY8s.jsView on unpkg · L865

dist/i18n-DKNpps8M.jsView file

11patternName = generic_password severity = medium line = 11 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/i18n-DKNpps8M.js

dist/i18n-DKNpps8M.jsView on unpkg · L11

docs/help/faq.mdView file

1182patternName = generic_password severity = medium line = 1182 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/help/faq.md

docs/help/faq.mdView on unpkg · L1182

docs/gateway/tailscale.mdView file

80patternName = generic_password severity = medium line = 80 matchedText = auth: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/gateway/tailscale.md

docs/gateway/tailscale.mdView on unpkg · L80

docs/gateway/configuration-reference.mdView file

535patternName = generic_password severity = medium line = 535 matchedText = // passw...WORD

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L535

570patternName = generic_password severity = medium line = 570 matchedText = // passw...rd",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L570

docs/gateway/config-channels.mdView file

783patternName = generic_password severity = medium line = 783 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in docs/gateway/config-channels.md

docs/gateway/config-channels.mdView on unpkg · L783

docs/channels/matrix.mdView file

63patternName = generic_password severity = medium line = 63 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L63

docs/channels/irc.mdView file

218patternName = generic_password severity = medium line = 218 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L218

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/dist-BljnBpL7.jsView file

5591patternName = private_key_rsa severity = critical line = 5591 matchedText = if (type...g");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/dist-BljnBpL7.jsView on unpkg · L5591

5591patternName = private_key_rsa severity = critical line = 5591 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/dist-BljnBpL7.js

dist/dist-BljnBpL7.jsView on unpkg · L5591

13350patternName = generic_password severity = medium line = 13350 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-BljnBpL7.js

dist/dist-BljnBpL7.jsView on unpkg · L13350

dist/channel.runtime-BFLIodGi.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/channel.runtime-BFLIodGi.jsView on unpkg · L28

4430async loadEventStreamCapability() { L4431: const { EventStreamSerde, eventStreamSerdeProvider } = await import("./event-streams-xeqAkkiV.js"); L4432: return new EventStreamSerde({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channel.runtime-BFLIodGi.jsView on unpkg · L4430

dist/control-ui/assets/config-runtime-BxOat2Bj.jsView file

5contains invisible/control Unicode U+200C (zero width non-joiner) `&&i(),``;case`1`:case`2`:case`3`:case`4`:case`5`:case`6`:case`7`:case`8`:case`9`:throw f(i());case void 0:throw f(i())}return i()}function c(){let e=``,t=r();if(!m.isHexDigit(t)||(e+=i(),t=r(),!m.isHexDigit(t)))throw f(i());return e+=i(),S

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/config-runtime-BxOat2Bj.jsView on unpkg · L5