registry / @alfe.ai/openclaw-sync / 0.1.11

@alfe.ai/openclaw-sync@0.1.11

AlfeSync — agent workspace backup and sync skill for OpenClaw

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The package is an OpenClaw sync plugin/CLI that can upload, download, overwrite, and delete agent workspace files after activation or CLI use. The main unresolved risk is remote path handling in private sync/restore paths, not evidence of intentional malware.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

OpenClaw plugin startup/hooks or user running alfesync pull/restore/realtime sync

Impact

Remote manifest or restore entries could write outside the workspace if upstream data is malicious or compromised; normal operation exfiltrates selected workspace files to Alfe/S3 as documented.

Mechanism

remote-controlled workspace sync with insufficient private path containment

Attack narrative

On activation or lifecycle hooks, the plugin resolves Alfe credentials, syncs the configured workspace, connects to an Alfe relay, and responds to remote file notifications by pulling or deleting files. This is consistent with the package purpose, but private sync and restore paths do not validate that remote paths stay inside workspacePath, creating a real path traversal risk if remote state is attacker-controlled.

Rationale

Static inspection does not confirm malicious payload execution or hidden install-time behavior; the scanner's decode/execute claim was not supported by source. The package should be warned for dangerous agent-workspace sync behavior and path containment gaps, not publish-blocked as malware.

Evidence

package.jsonopenclaw.plugin.jsonREADME.mddist/plugin.jsdist/plugin2.jsdist/sync-engine.jsdist/cli/index.js~/.alfe/sync/manifest.jsonworkspace filesshared/org/*shared/teams/*shared/projects/*

Network endpoints4

wss://sync.dev.alfe.ai/wswss://sync.demo.alfe.ai/wswss://sync.test.alfe.ai/wswss://sync.alfe.ai/ws

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

openclaw.plugin.json starts onStartup and runs alfesync pull/push hooks on agent lifecycle
dist/sync-engine.js writes remote manifest paths with join(workspacePath, relativePath) without containment checks
dist/cli/index.js restore writes bundle file.path under workspace without traversal validation
dist/plugin2.js WebSocket relay can trigger pull/delete of workspace files by remote notifications

Evidence against

No package.json install/preinstall/postinstall lifecycle scripts
dist/plugin2.js scanner-indicated remote decode/execute behavior not present; no eval/Function use found
Network use is aligned with documented Alfe sync, S3 presigned URL, and relay functionality
Shared sync path has assertContained and file-size cap
README and manifest describe workspace backup/sync behavior

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 10 file(s), 127 KB of source

Source & flagged code

3 flagged

dist/plugin2.jsView file

Lines 87-127javascript

87const MAX_SHARED_FILE_SIZE = 100 * 1024 * 1024;

88/** Throw if `resolvedPath` would escape `baseDir`. */

89function assertContained(baseDir, resolvedPath) {

90 const normalizedBase = normalize(baseDir) + sep;

91 const normalizedPath = normalize(resolvedPath);

92 if (!normalizedPath.startsWith(normalizedBase) && normalizedPath !== normalize(baseDir)) throw new Error(`Path traversal blocked: ${resolvedPath} escapes ${baseDir}`);

93}

94function createSharedSyncEngine(config, log) {

95 let activeScopes = [];

96 const sharedDir = join(config.workspacePath, "shared");

97 function scopeDir(scope) {

98 if (scope.scopeType === "org") return join(sharedDir, "org");

99 return join(sharedDir, scope.scopeType === "team" ? "teams" : "projects", scope.scopeId);

100 }

101 async function downloadFile(scope, filePath, localPath) {

102 assertContained(scopeDir(scope), localPath);

103 const { downloadUrl } = await config.client.sharedDownloadUrl({

104 scope: scope.scopeType,

105 scopeId: scope.scopeId,

106 filePath

107 });

108 const response = await fetch(downloadUrl);

109 if (!response.ok) throw new Error(`Download failed: HTTP ${String(response.status)}`);

110 const contentLength = parseInt(response.headers.get("content-length") ?? "0", 10);

111 if (contentLength > MAX_SHARED_FILE_SIZE) throw new Error(`File too large: ${String(contentLength)} bytes exceeds ${String(MAX_SHARED_FILE_SIZE)} limit`);

112 const buffer = Buffer.from(await response.arrayBuffer());

113 if (buffer.length > MAX_SHARED_FILE_SIZE) throw new Error(`Downloaded file exceeds size limit: ${String(buffer.length)} bytes`);

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/plugin2.jsView on unpkg · L107

114 await mkdir(dirname(localPath), { recursive: true });

115 await writeFile(localPath, buffer);

116 }

117 async function syncScope(scope) {

118 const dir = scopeDir(scope);

119 await mkdir(dir, { recursive: true });

120 try {

121 const { files } = await config.client.sharedListFiles({

122 scope: scope.scopeType,

123 scopeId: scope.scopeId

124 });

125 for (const file of files) {

126 const localPath = join(dir, file.filePath);

127 try {

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/plugin2.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin2.jsView on unpkg

dist/plugin2.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @alfe.ai/openclaw-sync@0.1.10 matchedIdentity = npm:QGFsZmUuYWkvb3BlbmNsYXctc3luYw:0.1.10 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/plugin2.cjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/plugin2.jsView file

107}); L108: const response = await fetch(downloadUrl); L109: if (!response.ok) throw new Error(`Download failed: HTTP ${String(response.status)}`); ... L111: if (contentLength > MAX_SHARED_FILE_SIZE) throw new Error(`File too large: ${String(contentLength)} bytes exceeds ${String(MAX_SHARED_FILE_SIZE)} limit`); L112: const buffer = Buffer.from(await response.arrayBuffer()); L113: if (buffer.length > MAX_SHARED_FILE_SIZE) throw new Error(`Downloaded file exceeds size limit: ${String(buffer.length)} bytes`); ... L296: */ L297: const pkg = createRequire(import.meta.url)("../package.json"); L298: const SYNC_CAPABILITIES = [ ... L472: syncRelayReconnectAttempt = 0; L473: ws.send(JSON.stringify({ L474: type: "SUBSCRIBE",

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/plugin2.jsView on unpkg · L107

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/plugin2.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin2.jsView on unpkg

dist/plugin2.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/plugin2.cjsView on unpkg

Findings

3 Critical1 High2 Medium4 Low

CriticalRemote Asset Decode Executedist/plugin2.js

CriticalTrigger Reachable Dangerous Capabilitydist/plugin2.js

CriticalPrevious Version Dangerous Deltadist/plugin2.cjs

HighChild Process

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

3 flagged

dist/plugin2.jsView file

Lines 87-127javascript

87const MAX_SHARED_FILE_SIZE = 100 * 1024 * 1024;

88/** Throw if `resolvedPath` would escape `baseDir`. */

89function assertContained(baseDir, resolvedPath) {

90 const normalizedBase = normalize(baseDir) + sep;

91 const normalizedPath = normalize(resolvedPath);

92 if (!normalizedPath.startsWith(normalizedBase) && normalizedPath !== normalize(baseDir)) throw new Error(`Path traversal blocked: ${resolvedPath} escapes ${baseDir}`);

93}

94function createSharedSyncEngine(config, log) {

95 let activeScopes = [];

96 const sharedDir = join(config.workspacePath, "shared");

97 function scopeDir(scope) {

98 if (scope.scopeType === "org") return join(sharedDir, "org");

99 return join(sharedDir, scope.scopeType === "team" ? "teams" : "projects", scope.scopeId);

100 }

101 async function downloadFile(scope, filePath, localPath) {

102 assertContained(scopeDir(scope), localPath);

103 const { downloadUrl } = await config.client.sharedDownloadUrl({

104 scope: scope.scopeType,

105 scopeId: scope.scopeId,

106 filePath

107 });

108 const response = await fetch(downloadUrl);

109 if (!response.ok) throw new Error(`Download failed: HTTP ${String(response.status)}`);

110 const contentLength = parseInt(response.headers.get("content-length") ?? "0", 10);

111 if (contentLength > MAX_SHARED_FILE_SIZE) throw new Error(`File too large: ${String(contentLength)} bytes exceeds ${String(MAX_SHARED_FILE_SIZE)} limit`);

112 const buffer = Buffer.from(await response.arrayBuffer());

113 if (buffer.length > MAX_SHARED_FILE_SIZE) throw new Error(`Downloaded file exceeds size limit: ${String(buffer.length)} bytes`);

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/plugin2.jsView on unpkg · L107

114 await mkdir(dirname(localPath), { recursive: true });

115 await writeFile(localPath, buffer);

116 }

117 async function syncScope(scope) {

118 const dir = scopeDir(scope);

119 await mkdir(dir, { recursive: true });

120 try {

121 const { files } = await config.client.sharedListFiles({

122 scope: scope.scopeType,

123 scopeId: scope.scopeId

124 });

125 for (const file of files) {

126 const localPath = join(dir, file.filePath);

127 try {

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/plugin2.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin2.jsView on unpkg

dist/plugin2.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/plugin2.cjsView on unpkg