registry / @aiyiran/myclaw / 1.1.192

@aiyiran/myclaw@1.1.192

为 OpenClaw 教学环境设计的一站式命令行工具。

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Explicit `mc server` or `mc init` installs and launches a persistent local sync daemon. The daemon uploads files from every OpenClaw workspace to a package-controlled CDN namespace and injects a browser telemetry probe into uploaded HTML.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `mc server` or `mc init`.

Impact

Exfiltrates workspace contents and captures interactive page telemetry outside the stated local-agent configuration role.

Mechanism

Persistent workspace scanning, cloud upload, and HTML telemetry-probe injection.

Attack narrative

When invoked through `mc server` or the `mc init` workflow, the package copies and starts `sync_workspace.py` under `~/.openclaw`. That daemon continuously enumerates every directory whose name contains `workspace`, uploads changed files using embedded cloud-storage credentials, and exposes them via the yiranlaoshi CDN namespace. Before uploading HTML, it injects a probe that records keyboard and click events plus console/error data. This is a concrete data-exfiltration and telemetry collection chain, not merely a configuration helper.

Rationale

Although the package has no install lifecycle hook, its explicit CLI workflow establishes persistent collection and uploads broad OpenClaw workspace content to an external package-controlled endpoint. The behavior exceeds a local agent-management tool and is concrete exfiltration.

Evidence

package.jsonindex.jsserver/sync_workspace.pyassets/debug-probe.jsserver/myclaw-guard.sh~/.openclaw/myclaw/server/sync_workspace.py~/.openclaw/workspace*

Network endpoints1

cdn.yiranlaoshi.com/{claw}/{workspace...}

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.js` runs `mc server` from `mc init` and starts the bundled sync daemon.
`server/sync_workspace.py` scans every `~/.openclaw/workspace*` directory, excluding only limited patterns.
Each changed workspace file is uploaded through Qiniu and published under `https://cdn.yiranlaoshi.com/{claw}/{workspace...}`.
The sync daemon embeds cloud storage credentials in source and continuously reconciles/uploads changes.
HTML uploads are modified in transit to inject `assets/debug-probe.js`, which captures clicks, keystrokes, console output, and errors.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
The upload daemon is activated by explicit CLI commands (`mc server` or `mc init`), not package import.
No evidence of an additional hidden remote payload loader was found in inspected entrypoint and sync paths.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 671 KB of source, external domains: 127.0.0.1, api.b.ai, api.minimaxi.com, api.tavily.com, api.vveai.com, cdn.yiranlaoshi.com, mirrors.aliyun.com, open.bigmodel.cn, openclaw.ai, registry.npmjs.org, registry.npmmirror.com, tavily.com, view.officeapps.live.com, www.apple.com, www.google.cn, www.google.com, www.w3.org, www.yiranlaoshi.com, x.x.x.x

Source & flagged code

8 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 // Windows 上 '/' 会被解释成当前盘符根目录（如 E:\root\.openclaw），

31 // 不是真正的文件系统根，因此 /root/.openclaw 判断只在非 Windows 上有意义。

32 if (process.platform !== 'win32' && fs.existsSync('/root/.openclaw')) {

33 return '/root/.openclaw';

34 }

35 return path.join(os.homedir(), '.openclaw');

36}

38// ─────────────────────────────────────────────

39// listAllAgents

40// ─────────────────────────────────────────────

42/**

Lines 153-193javascript

153

154 // ── macOS ──

155 if (plat === 'darwin') {

156 const trashDir = path.join(os.homedir(), '.Trash');

157 const base = path.basename(p);

158 let dest = path.

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

12 * Windows 支持说明:

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

Source & flagged code

8 flagged · loading source

delete_agents.jsView file

22const os = require('os'); L23: const { spawnSync, execSync } = require('child_process'); L24:

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

173const psCmd = `Add-Type -AssemblyName Microsoft.VisualBasic; [Microsoft.VisualBasic.FileIO.FileSystem]::${method}(${extraArgs})`; L174: const ret = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 15000 }); L175: if (ret.status === 0) return { ok: true, method: 'powershell' };

High

Shell

Package source references shell execution.

delete_agents.jsView on unpkg · L173

19L20: const fs = require('fs'); L21: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

index.jsView file

1608console.log(' ' + colors.dim + '→ 正在打开浏览器...' + colors.nc); L1609: const { exec } = require('child_process'); L1610: const fs = require('fs'); L1611: const machineUrl = 'https://' + selected.claw + '.kekouen.cn?token=aiyiran'; L1612: const platform = os.platform(); ... L1616: const chromeCandidates = [ L1617: path.join(process.env.PROGRAMFILES || 'C:\\Program Files', 'Google', 'Chrome', 'Application', 'chrome.exe'), L1618: path.join(process.env['PROGRAMFILES(X86)'] || 'C:\\Program Files (x86)', 'Google', 'Chrome', 'Application', 'chrome.exe'),

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L1608

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

14* - Windows 7/8/10 旧版本: 颜色代码会被 stripped，避免乱码 L15: * - 推荐 Windows 用户使用 Windows Terminal 或 PowerShell 7+ 获得最佳体验 L16: * - Emoji 符号在 Windows 命令行可能显示为方块，属正常现象 ... L30: const { createAgent } = require('./create_agent'); L31: const { version } = require(path.join(__dirname, 'package.json')); L32: const { TOKEN, DEFAULT_URL } = require(path.join(__dirname, 'config')); ... L81: console.log('[Windows] 检测到 Windows 系统，正在安装...'); L82: const cmd = 'powershell -c "irm https://openclaw.ai/install.ps1 | iex"'; L83: console.log('> ' + cmd); ... L165: stdio: 'inherit', L166: env: { ...process.env, npm[redacted]: 'true' } L167: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L14

163try { L164: execSync('npm install -g openclaw@' + targetVersion, { L165: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L163

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

Findings

2 Critical4 High5 Medium4 Low

CriticalSame File Env Network Executionindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processdelete_agents.js

HighShelldelete_agents.js

HighSandbox Evasion Gated Capabilityindex.js

HighRuntime Package Installindex.js

MediumDynamic Requiredelete_agents.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpublish.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 // Windows 上 '/' 会被解释成当前盘符根目录（如 E:\root\.openclaw），

31 // 不是真正的文件系统根，因此 /root/.openclaw 判断只在非 Windows 上有意义。

32 if (process.platform !== 'win32' && fs.existsSync('/root/.openclaw')) {

33 return '/root/.openclaw';

34 }

35 return path.join(os.homedir(), '.openclaw');

36}

38// ─────────────────────────────────────────────

39// listAllAgents

40// ─────────────────────────────────────────────

42/**

Lines 153-193javascript

153

154 // ── macOS ──

155 if (plat === 'darwin') {

156 const trashDir = path.join(os.homedir(), '.Trash');

157 const base = path.basename(p);

158 let dest = path.

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

12 * Windows 支持说明:

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

Lines 1588-1628javascript

1588const MACHINE_ZERO = { name: '依然', claw: 'claw', desc: '依然的机器' };

1589

1590const MACHINE_CONFIG = [

1591 { name: 'kendy', claw: 'claw1', desc: 'kendy 的机器' },

1592 { name: 'Ethan', claw: 'claw2', desc: 'Ethan 的机器' },

1593 { name: 'HENRY', claw: 'claw3', desc: 'HENRY 的机器' },

1594 { name: 'Mo靖宇', claw: 'claw4', desc: 'Mo靖宇的机器' },

1595 { name: '高兴', claw: 'claw5', desc: '高兴的机器' },

1596 { name: '伊伊', claw: 'claw6', desc: '伊伊的机器' },

1597 { name: '梓浩', claw: 'claw7', desc: '梓浩的机器' },

1598 { name: '刘泓毅', claw: 'claw8', desc: '刘泓毅的机器' },

1599 { name: 'Mia', claw: 'claw9', desc: 'Mia 的机器' },

1600 { name: '雨熙', claw: 'claw10', desc: '雨熙的机器' },

1601 { name: '绍博', claw: 'claw11', desc: '绍博的机器' },

1602 { name: '黄玺澄', claw: 'claw12', desc: '玺澄的机器' },

1603];

1604

1605function openMachine(selected) {

1606 console.log('');

1607 console.log(colors.green + ' → 已选择: ' + selected.name + ' (' + selected.claw + ')' + colors.nc);

1608 console.log(' ' + colors.dim + '→ 正在打开浏览器...' + colors.nc);

1609 const { exec } = require('child_process');

1610 const fs = require('fs');

1611 const machineUrl = 'https://' + selected.claw + '.kekouen.cn?token=aiyiran';

1612 const platform = os.platform();

1613 if (platform === 'darwin') {

1614 exec('open -a "Google Chrome" "' + machineUrl + '"');

1615 } else if (platform === 'win32') {

1616 const chromeCandidates = [

1617 path.join(process.env.PROGRAMFILES || 'C:\\Program Files', 'Google', 'Chrome', 'Application', 'chrome.exe'),

1618 path.join(process.env['PROGRAMFILES(X86)'] || 'C:\\Program Files (x86)', 'Google', 'Chrome', 'Application', 'chrome.exe'),

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L1608

1619 path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'Google', 'Chrome', 'Application', 'chrome.exe'),

1620 ];

1621 const chromePath = chromeCandidates.find(function (p) { try { return fs.existsSync(p); } catch { return false; } });

1622 if (chromePath) {

1623 exec('"' + chromePath + '" "' + machineUrl + '"');

1624 } else {

1625 exec('start "" "' + machineUrl + '"', { shell: true });

1626 }

1627 } else {

1628 exec('xdg-open "' + machineUrl + '"');