registry / Destructive action / @aiyiran/myclaw

@aiyiran/myclaw

为 OpenClaw 教学环境设计的一站式命令行工具。

This report shows the evidence for @aiyiran/myclaw@1.1.205. 3 of 20 known versions are blocked or flagged. The newest version, 1.1.209, is flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The hard-coded removal of a purported competitor is destructive behavior, and the automatic patch configuration deliberately disables multiple agent control protections. No install hook exists, but the explicit commands still implement concrete harmful behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs `mc all`, `mc patch`, or a command that invokes the patch flow.

Impact

It can remove an unrelated root script and leave the agent control interface open to arbitrary origins without device authentication or execution confirmation.

Mechanism

Targeted process and file deletion plus broad OpenClaw control-surface weakening.

Attack narrative

The package's `all` command terminates and deletes a specifically named root script while calling it a competitor. Its patch path injects several scripts into a separately installed OpenClaw UI, disables execution confirmation, enables full execution security, accepts all control-UI origins, and disables device authentication. These changes create a broad takeover surface beyond ordinary UI customization.

AI rationale

Evidence

index.jspatches/patch-manifest.jsoninjects/inject-controlui.jspatches/patch.js/root/sync_workspace.pyOpenClaw control-ui/index.htmlOpenClaw gateway configuration file

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The `all` command kills and deletes a hard-coded `/root/sync_workspace.py` described as a competitor.
The patch flow automatically disables OpenClaw execution confirmation and sets execution security to full.
The patch manifest automatically runs a module that disables device authentication and permits every browser origin.
The patcher injects multiple package scripts into OpenClaw's control UI and broadly relaxes its content security policy.
The patcher changes OpenClaw’s connect-src CSP directive to allow every origin.

Evidence against

package.json has no install lifecycle hook.
The destructive and configuration-changing behavior is reached through explicit CLI commands, not package installation.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

20 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 // Windows 上 '/' 会被解释成当前盘符根目录（如 E:\root\.openclaw），

31 // 不是真正的文件系统根，因此 /root/.openclaw 判断只在非 Windows 上有意义。

32 if (process.platform !== 'win32' && fs.existsSync('/root/.openclaw')) {

33 return '/root/.openclaw';

34 }

35 return path.join(os.homedir(), '.openclaw');

36}

38// ─────────────────────────────────────────────

39// listAllAgents

40// ─────────────────────────────────────────────

42/**

Lines 153-193javascript

153

154 // ── macOS ──

155 if (plat === 'darwin') {

156 const trashDir = path.join(os.homedir(), '.Trash');

157 const base

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

prepare.jsView file

Lines 2-42javascript

3/**

4 * ============================================================================

5 * MyClaw Prepare - 智能初始化链条

6 * ============================================================================

7 *

8 * 使用: myclaw prepare

9 *

10 * 按顺序执行以下检测和操作：

11 * Step 1: 检测环境（Windows / Mac / Linux-WSL）

12 * Step 2: 检测 Chrome 浏览器

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1521 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

gateway.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = gateway.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High