registry / @agentlayer.tech/wallet / 0.1.106
@agentlayer.tech/wallet@0.1.106
Universal AgentLayer wallet installer for OpenClaw, Codex, Claude Code, and Hermes.
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection found no npm lifecycle hook or concrete attack behavior. The flagged configuration write is reached through the CLI installer, while telemetry is limited to package operation metadata sent to the package gateway.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the wallet CLI install or update command; telemetry can be disabled through its environment setting.
Impact
No credential theft, unconsented broad agent control change, or other concrete attack was established.
Mechanism
The CLI records limited operation metadata and sends it to the package gateway. The Claude Code installer pins the OpenClaw home path in cached plugin configuration.
AI rationale
Source inspection found no npm lifecycle hook or concrete attack behavior. The flagged configuration write is reached through the CLI installer, while telemetry is limited to package operation metadata sent to the package gateway.
Network endpoints1
agent-layer-production.up.railway.app/v1/telemetry
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes an explicit wallet CLI and lists check, build, release, and test scripts; it declares no npm install lifecycle hook.
- The flagged cache pin runs as part of the Claude Code install command and updates cached plugin configuration with the OpenClaw home path.
- CLI telemetry sends a limited event record with a random install identifier, agent host, package version, command, and status to the package gateway; it can be disabled with an environment setting.
- The connector smoke helper packs local connector packages and checks their archives; it is a development helper.
- The EVM daemon helper targets loopback and checks the service identity, data directory, process, and ownership before allowing a stop.
Evidence against
- Telemetry is recorded automatically during CLI operations unless disabled, but the inspected payload contains no wallet credentials or agent conversation content.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedconnectors/scripts/smoke-packed-packages.mjsView file
1import { execFileSync } from "node:child_process";
L2: import { createHash } from "node:crypto";
High
Child Process
Package source references child process execution.
connectors/scripts/smoke-packed-packages.mjsView on unpkg · L1bin/openclaw-agent-wallet.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @agentlayer.tech/wallet@0.1.109
matchedIdentity = npm:QGFnZW50bGF5ZXIudGVjaC93YWxsZXQ:0.1.109
similarity = 0.860
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/openclaw-agent-wallet.mjsView on unpkgFindings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/openclaw-agent-wallet.mjs
HighChild Processconnectors/scripts/smoke-packed-packages.mjs
HighShellbin/openclaw-agent-wallet.mjs
HighSame File Env Network Executionbin/lib/evm-daemon.mjs
HighRuntime Package Installbin/openclaw-agent-wallet.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpersetup.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @agentlayer.tech/wallet@0.1.106.
See all versions of @agentlayer.tech/wallet for other recorded verdicts.
- Review the evidence and your use of @agentlayer.tech/wallet@0.1.106 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.