registry / @aiyiran/myclaw / 1.1.205

@aiyiran/myclaw@1.1.205

为 OpenClaw 教学环境设计的一站式命令行工具。

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Running `mc all` deletes a fixed root-owned script labelled as a competitor. Running the patch flow weakens OpenClaw authentication and execution safeguards while injecting package code into its UI.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs `mc all`, `mc patch`, or a command that invokes the patch flow.

Impact

It can remove an unrelated root script and leave the agent control interface open to arbitrary origins without device authentication or execution confirmation.

Mechanism

Targeted process and file deletion plus broad OpenClaw control-surface weakening.

Attack narrative

The package's `all` command terminates and deletes a specifically named root script while calling it a competitor. Its patch path injects several scripts into a separately installed OpenClaw UI, disables execution confirmation, enables full execution security, accepts all control-UI origins, and disables device authentication. These changes create a broad takeover surface beyond ordinary UI customization.

AI rationale

The hard-coded removal of a purported competitor is destructive behavior, and the automatic patch configuration deliberately disables multiple agent control protections. No install hook exists, but the explicit commands still implement concrete harmful behavior.

Evidence

index.jspatches/patch-manifest.jsoninjects/inject-controlui.jspatches/patch.js/root/sync_workspace.pyOpenClaw control-ui/index.htmlOpenClaw gateway configuration file

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The `all` command kills and deletes a hard-coded `/root/sync_workspace.py` described as a competitor.
The patch flow automatically disables OpenClaw execution confirmation and sets execution security to full.
The patch manifest automatically runs a module that disables device authentication and permits every browser origin.
The patcher injects multiple package scripts into OpenClaw's control UI and broadly relaxes its content security policy.
The patcher changes OpenClaw’s connect-src CSP directive to allow every origin.

Evidence against

package.json has no install lifecycle hook.
The destructive and configuration-changing behavior is reached through explicit CLI commands, not package installation.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 705 KB of source, external domains: 127.0.0.1, api.b.ai, api.minimaxi.com, api.tavily.com, api.vveai.com, cdn.yiranlaoshi.com, mirrors.aliyun.com, open.bigmodel.cn, openclaw.ai, registry.npmjs.org, registry.npmmirror.com, tavily.com, view.officeapps.live.com, www.apple.com, www.google.cn, www.google.com, www.w3.org, www.yiranlaoshi.com, x.x.x.x

Source & flagged code

20 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 // Windows 上 '/' 会被解释成当前盘符根目录（如 E:\root\.openclaw），

31 // 不是真正的文件系统根，因此 /root/.openclaw 判断只在非 Windows 上有意义。

32 if (process.platform !== 'win32' && fs.existsSync('/root/.openclaw')) {

33 return '/root/.openclaw';

34 }

35 return path.join(os.homedir(), '.openclaw');

36}

38// ─────────────────────────────────────────────

39// listAllAgents

40// ─────────────────────────────────────────────

42/**

Lines 153-193javascript

153

154 // ── macOS ──

155 if (plat === 'darwin') {

156 const trashDir = path.join(os.homedir(), '.Trash');

157 const base

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

prepare.jsView file

Lines 2-42javascript

3/**

4 * ============================================================================

5 * MyClaw Prepare - 智能初始化链条

6 * ============================================================================

7 *

8 * 使用: myclaw prepare

9 *

10 * 按顺序执行以下检测和操作：

11 * Step 1: 检测环境（Windows / Mac / Linux-WSL）

12 * Step 2: 检测 Chrome 浏览器

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1521 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

gateway.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = gateway.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

gateway.jsView on unpkg

launch.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = launch.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

launch.jsView on unpkg

patches/patch.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = patches/patch.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

patches/patch.jsView on unpkg

restrict.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = restrict.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

restrict.jsView on unpkg

skills/minimax-inject/scripts/inject.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = skills/minimax-inject/scripts/inject.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/minimax-inject/scripts/inject.jsView on unpkg

injects/inject-minimax.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = injects/inject-minimax.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

injects/inject-minimax.jsView on unpkg

wizards/scripts/create_agent_steps.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = wizards/scripts/create_agent_steps.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wizards/scripts/create_agent_steps.jsView on unpkg

injects/inject-zai.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = injects/inject-zai.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

injects/inject-zai.jsView on unpkg

Source & flagged code

20 flagged · loading source

delete_agents.jsView file

22const os = require('os'); L23: const { spawnSync, execSync } = require('child_process'); L24:

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

173const psCmd = `Add-Type -AssemblyName Microsoft.VisualBasic; [Microsoft.VisualBasic.FileIO.FileSystem]::${method}(${extraArgs})`; L174: const ret = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 15000 }); L175: if (ret.status === 0) return { ok: true, method: 'powershell' };

High

Shell

Package source references shell execution.

delete_agents.jsView on unpkg · L173

19L20: const fs = require('fs'); L21: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

index.jsView file

1624console.log(' ' + colors.dim + '→ 正在打开浏览器...' + colors.nc); L1625: const { exec } = require('child_process'); L1626: const fs = require('fs'); L1627: const machineUrl = 'https://' + selected.claw + '.kekouen.cn?token=aiyiran'; L1628: const platform = os.platform(); ... L1632: const chromeCandidates = [ L1633: path.join(process.env.PROGRAMFILES || 'C:\\Program Files', 'Google', 'Chrome', 'Application', 'chrome.exe'), L1634: path.join(process.env['PROGRAMFILES(X86)'] || 'C:\\Program Files (x86)', 'Google', 'Chrome', 'Application', 'chrome.exe'),

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L1624

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

14* - Windows 7/8/10 旧版本: 颜色代码会被 stripped，避免乱码 L15: * - 推荐 Windows 用户使用 Windows Terminal 或 PowerShell 7+ 获得最佳体验 L16: * - Emoji 符号在 Windows 命令行可能显示为方块，属正常现象 ... L30: const { createAgent } = require('./create_agent'); L31: const { version } = require(path.join(__dirname, 'package.json')); L32: const { TOKEN, DEFAULT_URL } = require(path.join(__dirname, 'config')); ... L81: console.log('[Windows] 检测到 Windows 系统，正在安装...'); L82: const cmd = 'powershell -c "irm https://openclaw.ai/install.ps1 | iex"'; L83: console.log('> ' + cmd); ... L165: stdio: 'inherit', L166: env: { ...process.env, npm[redacted]: 'true' } L167: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L14

163try { L164: execSync('npm install -g openclaw@' + targetVersion, { L165: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L163

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = index.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

prepare.jsView file

22L23: const { execSync } = require('child_process'); L24: const os = require('os'); ... L39: // 检测是否在 npm postinstall 中运行（非交互模式） L40: const isPostInstall = process.env.npm[redacted] === 'postinstall'; L41: ... L64: input: process.stdin, L65: output: process.stdout, L66: }); ... L157: console.log(' 请前往以下地址下载安装 Chrome:'); L158: console.log(' ' + C.y + 'https://www.google.cn/intl/zh-CN/chrome/' + C.nc); L159: console.log('');

Critical

Download Execute

Source downloads or fetches remote code and executes it.

prepare.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = prepare.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

prepare.jsView on unpkg

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1521 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

gateway.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

gateway.jsView on unpkg

launch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

launch.jsView on unpkg

patches/patch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

patches/patch.jsView on unpkg

restrict.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

restrict.jsView on unpkg

skills/minimax-inject/scripts/inject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/minimax-inject/scripts/inject.jsView on unpkg

injects/inject-minimax.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

injects/inject-minimax.jsView on unpkg

wizards/scripts/create_agent_steps.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wizards/scripts/create_agent_steps.jsView on unpkg

injects/inject-zai.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

injects/inject-zai.jsView on unpkg

Findings

3 Critical15 High5 Medium4 Low

CriticalSame File Env Network Executionindex.js

CriticalDownload Executeprepare.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processdelete_agents.js

HighShelldelete_agents.js

HighSandbox Evasion Gated Capabilityindex.js

HighRuntime Package Installindex.js

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Similarityprepare.js

HighKnown Malware Source Similaritygateway.js

HighKnown Malware Source Similaritylaunch.js

HighKnown Malware Source Similaritypatches/patch.js

HighKnown Malware Source Similarityrestrict.js

HighKnown Malware Source Similarityskills/minimax-inject/scripts/inject.js

HighKnown Malware Source Similarityinjects/inject-minimax.js

HighKnown Malware Source Similaritywizards/scripts/create_agent_steps.js

HighKnown Malware Source Similarityinjects/inject-zai.js

MediumDynamic Requiredelete_agents.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpublish.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @aiyiran/myclaw@1.1.205.

See version security history for other recorded verdicts.

Avoid installing @aiyiran/myclaw@1.1.205. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-17 02:40:25.831Z (UTC).