@aiyiran/myclaw@1.1.208
为 OpenClaw 教学环境设计的一站式命令行工具。
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains an explicit-command workflow that broadly weakens an AI-agent control surface, but no npm lifecycle trigger or confirmed credential exfiltration. This meets the policy threshold for a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs myclaw patch, or a CLI workflow that calls the patch routine.
Impact
The affected OpenClaw instance may accept untrusted origins, bypass device authentication, and run tools with reduced approval safeguards.
Mechanism
Broad OpenClaw configuration and control-UI security weakening.
AI rationale
The package contains an explicit-command workflow that broadly weakens an AI-agent control surface, but no npm lifecycle trigger or confirmed credential exfiltration. This meets the policy threshold for a warning rather than a publish block.
Evidence
index.jspatches/patch-manifest.jsoninjects/inject-controlui.jspatches/patch.js~/.openclaw/openclaw.jsonopenclaw/dist/control-ui/index.htmlopenclaw/dist/*.js
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked patch command runs a bundled patch workflow.
- That workflow weakens OpenClaw execution approval and security settings.
- A bundled injector disables device authentication and permits every origin.
- The UI patch changes installed OpenClaw code to allow network connections and framing from any origin.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The risky code is reached through explicit CLI commands rather than package installation or import.
- No source-confirmed credential harvesting or external secret exfiltration was found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
21 flagged · loading sourcedelete_agents.jsView file
22const os = require('os');
L23: const { spawnSync, execSync } = require('child_process');
L24:
High
173const psCmd = `Add-Type -AssemblyName Microsoft.VisualBasic; [Microsoft.VisualBasic.FileIO.FileSystem]::${method}(${extraArgs})`;
L174: const ret = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 15000 });
L175: if (ret.status === 0) return { ok: true, method: 'powershell' };
High
19L20: const fs = require('fs');
L21: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
delete_agents.jsView on unpkg · L19index.jsView file
Findings
4 Critical15 High5 Medium4 Low
CriticalSame File Env Network Executionindex.js
CriticalDownload Executeprepare.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltafix.js
HighChild Processdelete_agents.js
HighShelldelete_agents.js
HighSandbox Evasion Gated Capabilityindex.js
HighRuntime Package Installindex.js
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similarityprepare.js
HighKnown Malware Source Similaritygateway.js
Affected versions and remediation
This report applies to @aiyiran/myclaw@1.1.208.
See all versions of @aiyiran/myclaw for other recorded verdicts.
- Review the evidence and your use of @aiyiran/myclaw@1.1.208 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.