registry / @agentlayer.tech/wallet / 0.1.89

@agentlayer.tech/wallet@0.1.89

⚠ Under review

NPM installer for the OpenClaw Agent Wallet local runtime.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 19 file(s), 528 KB of source, external domains: agent-layer-production.up.railway.app, api.mainnet-beta.solana.com, api.morpho.org, eth-api.lido.fi, eth.drpc.org, li.quest, mainnet.base.org, rpc.mainnet.chain.robinhood.com, sepolia.base.org, sepolia.drpc.org, trade-api.gateway.uniswap.org

Source & flagged code

6 flagged

README.mdView file

•If you are an individual developer, researcher, student, security reviewer, or hobbyist, you can:

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

bin/openclaw-agent-wallet.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn, spawnSync } from "node:child_process";

4import crypto from

Source & flagged code

6 flagged · loading source

README.mdView file

•If you are an individual developer, researcher, student, security reviewer, or hobbyist, you can:

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

bin/openclaw-agent-wallet.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agentlayer.tech/wallet@0.1.74 matchedIdentity = npm:QGFnZW50bGF5ZXIudGVjaC93YWxsZXQ:0.1.74 similarity = 0.688 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/openclaw-agent-wallet.mjsView on unpkg

2L3: import { spawn, spawnSync } from "node:child_process"; L4: import crypto from "node:crypto";

High

Child Process

Package source references child process execution.

bin/openclaw-agent-wallet.mjsView on unpkg · L2

549const result = spawnSync("command", ["-v", name], { L550: shell: true, L551: stdio: "ignore",

High

Shell

Package source references shell execution.

bin/openclaw-agent-wallet.mjsView on unpkg · L549

2555target_version: packageVersion, L2556: fix: `npm install --global ${packageJson.name}@${packageVersion}`, L2557: }; ... L2559: const packageSpec = `${packageJson.name}@${packageVersion}`; L2560: const result = spawnSync( L2561: installed.npm_bin,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/openclaw-agent-wallet.mjsView on unpkg · L2555

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 2795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

Findings

1 Critical4 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltabin/openclaw-agent-wallet.mjs

HighAi Reviewer ManipulationREADME.md

HighChild Processbin/openclaw-agent-wallet.mjs

HighShellbin/openclaw-agent-wallet.mjs

HighRuntime Package Installbin/openclaw-agent-wallet.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersetup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Lines 529-569javascript

529function resolvedCurrentRuntimeRoot(env = process.env) {

530 const currentPath = currentRuntimePath(env);

531 const currentTarget = readLinkOrNull(currentPath);

532 if (currentTarget) {

533 return path.resolve(path.dirname(currentPath), currentTarget);

534 }

535 try {

536 const stat = fs.statSync(currentPath);

537 if (stat.isDirectory()) return currentPath;

538 } catch (error) {

539 if (error?.code !== "ENOENT") throw error;

540 }

541 return "";

542}

543

544function previousRuntimePath(env = process.env) {

545 return path.join(resolveRuntimeBase(env), "previous");

546}

547

548function hasCommand(name) {

549 const result = spawnSync("command", ["-v", name], {

550 shell: true,

551 stdio: "ignore",

High

Shell

Package source references shell execution.

bin/openclaw-agent-wallet.mjsView on unpkg · L549

552 });

553 return result.status === 0;

554}

555

556function commandPath(name) {

557 const result = spawnSync("command", ["-v", name], {

558 shell: true,

559 encoding: "utf8",

560 });

561 if (result.status !== 0) return "";

562 return result.stdout.trim();

563}

564

565function pythonVersion(pythonBin) {

566 if (!pythonBin) return null;

567 const result = spawnSync(

568 pythonBin,

569 ["-c", "import sys,json; print(json.dumps({'version': sys.version.split()[0], 'major': sys.version_info[0], 'minor': sys.version_info[1]}))"],

Lines 2535-2575javascript

2535 return null;

2536 }

2537}

2538

2539function refreshGlobalCliIfNeeded(env = process.env) {

2540 const installed = globalNpmPackageInfo(env);

2541 if (!installed) {

2542 return { attempted: false, ok: true, reason: "global package is not installed" };

2543 }

2544 if (installed.version === packageVersion) {

2545 return { attempted: false, ok: true, reason: "already current", version: packageVersion };

2546 }

2547 const fromNpmCache = path.resolve(packageRoot).split(path.sep).includes("_npx");

2548 const forced = env.AGENT_WALLET_FORCE_GLOBAL_CLI_REFRESH === "1";

2549 if (!fromNpmCache && !forced) {

2550 return {

2551 attempted: false,

2552 ok: false,

2553 reason: "installer is not running from npm exec",

2554 installed_version: installed.version,

2555 target_version: packageVersion,

2556 fix: `npm install --global ${packageJson.name}@${packageVersion}`,

2557 };

2558 }

2559 const packageSpec = `${packageJson.name}@${packageVersion}`;

2560 const result = spawnSync(

2561 installed.npm_bin,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/openclaw-agent-wallet.mjsView on unpkg · L2555

2562 ["install", "--global", "--no-audit", "--no-fund", packageSpec],

2563 { encoding: "utf8", env },

2564 );

2565 return {

2566 attempted: true,

2567 ok: result.status === 0,

2568 previous_version: installed.version,

2569 target_version: packageVersion,

2570 error: result.status === 0 ? "" : (result.stderr || result.stdout || "").trim(),

2571 fix: result.status === 0 ? "" : `npm install --global ${packageSpec}`,

2572 };

2573}

2574

2575function safelyRefreshIntegration(name, callback) {