registry / AI-agent capability abuse / @aiyiran/myclaw / 1.1.207

@aiyiran/myclaw@1.1.207

为 OpenClaw 教学环境设计的一站式命令行工具。

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a concrete, user-invoked mechanism to weaken a foreign AI-agent control surface. Because package installation itself has no lifecycle hook and the changes require an explicit CLI workflow, this does not meet the install-hook blocking threshold.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs myclaw prepare, myclaw launch, or myclaw patch.

Impact

OpenClaw may accept less-protected control access and permit agent execution with full security settings.

Mechanism

OpenClaw configuration weakening and control UI script injection.

AI rationale

Evidence

patches/patch-manifest.jsoninjects/inject-controlui.jspatches/patch.js~/.openclaw/openclaw.jsonOpenClaw dist/control-ui/index.htmlOpenClaw dist/control-ui/myclaw-inject.js

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The patch manifest disables execution approval and sets execution security to full.
The patch automatically runs a module that permits insecure control UI access from every origin and disables device authentication.
The patch engine copies package scripts into the separately installed OpenClaw control UI and injects script tags.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The risky changes are activated by explicit CLI commands such as prepare, launch, or patch; no import-time execution was found.
No credential harvesting or outbound exfiltration was established in the inspected path.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

22 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 // Windows 上 '/' 会被解释成当前盘符根目录（如 E:\root\.openclaw），

31 // 不是真正的文件系统根，因此 /root/.openclaw 判断只在非 Windows 上有意义。

32 if (process.platform !== 'win32' && fs.existsSync('/root/.openclaw')) {

33 return '/root/.openclaw';

34 }

35 return path.join(os.homedir(), '.openclaw');

36}

38// ─────────────────────────────────────────────

39// listAllAgents

40// ─────────────────────────────────────────────

42/**

Lines 153-193javascript

153

154 // ── macOS ──

155 if (plat === 'darwin') {

156 const trashDir = path.join(os.homedir(), '.Trash');

157 const base

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

prepare.jsView file

Lines 2-42javascript

3/**

4 * ============================================================================

5 * MyClaw Prepare - 智能初始化链条

6 * ============================================================================

7 *

8 * 使用: myclaw prepare

9 *

10 * 按顺序执行以下检测和操作：

11 * Step 1: 检测环境（Windows / Mac / Linux-WSL）

12 * Step 2: 检测 Chrome 浏览器

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1521 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

fix.jsView file

•matchType = normalized_sha256 matchedPackage = @aiyiran/myclaw@1.1.203 matchedPath = fix.js matchedIdentity = npm:QGFpeWlyYW4vbXljbGF3:1.1.203 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High