registry / @aiyiran/myclaw / 1.1.200
@aiyiran/myclaw@1.1.200
⚠ Under review为 OpenClaw 教学环境设计的一站式命令行工具。
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 28 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
21 flagged · loading sourcedelete_agents.jsView file
22const os = require('os');
L23: const { spawnSync, execSync } = require('child_process');
L24:
High
173const psCmd = `Add-Type -AssemblyName Microsoft.VisualBasic; [Microsoft.VisualBasic.FileIO.FileSystem]::${method}(${extraArgs})`;
L174: const ret = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 15000 });
L175: if (ret.status === 0) return { ok: true, method: 'powershell' };
High
19L20: const fs = require('fs');
L21: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
delete_agents.jsView on unpkg · L19index.jsView file
Findings
4 Critical15 High5 Medium4 Low
CriticalSame File Env Network Executionindex.js
CriticalDownload Executeprepare.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighChild Processdelete_agents.js
HighShelldelete_agents.js
HighSandbox Evasion Gated Capabilityindex.js
HighRuntime Package Installindex.js
HighKnown Malware Source Similarityfix.js
HighKnown Malware Source Similarityprepare.js
HighKnown Malware Source Similaritywsl2.js
HighKnown Malware Source Similaritygateway.js
Affected versions and remediation
This report applies to @aiyiran/myclaw@1.1.200.
See all versions of @aiyiran/myclaw for other recorded verdicts.
- Review the evidence and your use of @aiyiran/myclaw@1.1.200 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.