registry  /  @chrysb/alphaclaw  /  0.9.20

@chrysb/alphaclaw@0.9.20

Setup UI, gateway manager, and onboarding wrapper for OpenClaw

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 365 file(s), 3.53 MB of source, external domains: accounts.google.com, aistudio.google.com, api.github.com, api.openai.com, api.slack.com, api.telegram.org, auth.openai.com, brave.com, console.anthropic.com, console.cloud.google.com, console.deepgram.com, console.developers.google.com, console.groq.com, console.mistral.ai, dash.voyageai.com, dashboard.render.com, discord.com, docs.cloud.google.com, docs.openclaw.ai, elevenlabs.io, esm.sh, github.com, oauth2.googleapis.com, openrouter.ai, platform.openai.com, railway.com, raw.githubusercontent.com, registry.npmjs.org, slack.com, t.me, www.chartjs.org, www.googleapis.com, www.w3.org

Source & flagged code

4 flagged · loading source
bin/alphaclaw.jsView file
6const path = require("path"); L7: const { execFileSync, execSync } = require("child_process"); L8: const {
High
Child Process

Package source references child process execution.

bin/alphaclaw.jsView on unpkg · L6
171// In environments where the container filesystem is ephemeral (Railway, etc.), L172: // the npm install from the update endpoint is lost on restart. This re-runs it L173: // from the fresh container using the persistent volume marker. ... L185: try { L186: execSync( L187: "npm install @chrysb/alphaclaw@latest --omit=dev --prefer-online",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/alphaclaw.jsView on unpkg · L171
3L4: const fs = require("fs"); L5: const os = require("os");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/alphaclaw.jsView on unpkg · L3
lib/setup/hourly-git-sync.shView file
•path = lib/setup/hourly-git-sync.sh kind = build_helper sizeBytes = 3183 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/setup/hourly-git-sync.shView on unpkg

Findings

3 High5 Medium6 Low
HighChild Processbin/alphaclaw.js
HighShell
HighRuntime Package Installbin/alphaclaw.js
MediumDynamic Requirebin/alphaclaw.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperlib/setup/hourly-git-sync.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings