registry / @aiyiran/myclaw / 1.1.195

@aiyiran/myclaw@1.1.195

⚠ Under review

为 OpenClaw 教学环境设计的一站式命令行工具。

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 20 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 671 KB of source, external domains: 127.0.0.1, api.b.ai, api.minimaxi.com, api.tavily.com, api.vveai.com, cdn.yiranlaoshi.com, mirrors.aliyun.com, open.bigmodel.cn, openclaw.ai, registry.npmjs.org, registry.npmmirror.com, tavily.com, view.officeapps.live.com, www.apple.com, www.google.cn, www.google.com, www.w3.org, www.yiranlaoshi.com, x.x.x.x

Source & flagged code

13 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 // Windows 上 '/' 会被解释成当前盘符根目录（如 E:\root\.openclaw），

31 // 不是真正的文件系统根，因此 /root/.openclaw 判断只在非 Windows 上有意义。

32 if (process.platform !== 'win32' && fs.existsSync('/root/.openclaw')) {

33 return '/root/.openclaw';

34 }

35 return path.join(os.homedir(), '.openclaw');

36}

38// ─────────────────────────────────────────────

39// listAllAgents

40// ─────────────────────────────────────────────

42/**

Lines 153-193javascript

153

154 // ── macOS ──

155 if (plat === 'darwin') {

156 const trashDir = path.join(os.homedir(), '.Trash');

157 const base

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

fix.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.192 matchedPath = fix.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.192 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

fix.jsView on unpkg

prepare.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.192 matchedPath = prepare.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.192 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

prepare.jsView on unpkg

skills/minimax-inject/scripts/inject.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.192 matchedPath = skills/minimax-inject/scripts/inject.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.192 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/minimax-inject/scripts/inject.jsView on unpkg

wsl2.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.192 matchedPath = wsl2.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.192 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wsl2.jsView on unpkg

Source & flagged code

13 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code