registry / Remote code execution / @clawos-dev/clawd
@clawos-dev/clawd
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
This report shows the evidence for @clawos-dev/clawd@0.2.549. 7 of 230 known versions are blocked or flagged. The newest version, 0.2.706, is allowed. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe unverified remote-script execution is a concrete remote-code-execution path, and the daemon also sends identified logs to a default external endpoint. Absence of an npm lifecycle hook limits installation-time impact but does not neutralize the runtime attack behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run clawd for telemetry; invoke engine:connectPool for remote code execution.
Impact
A remote portal response can execute arbitrary commands and access the process environment; runtime logs are sent externally by default.
Mechanism
Default log exfiltration and unverified remote shell execution.
Attack narrative
The package starts a daemon whose default configuration enables external log shipping. More seriously, its engine pool feature fetches a shell script from a package-controlled portal as plain text and pipes it to Bash. It passes the caller-provided API key and inherits the entire daemon environment, with no signature, checksum, or allowlisted command set. A compromised or malicious portal response can therefore run arbitrary commands and extract available credentials when an owner invokes that feature.
AI rationale
The unverified remote-script execution is a concrete remote-code-execution path, and the daemon also sends identified logs to a default external endpoint. Absence of an npm lifecycle hook limits installation-time impact but does not neutralize the runtime attack behavior.
Evidence
dist/cli.cjs
Network endpoints2
clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/trackcpa-portal-d417.app.clawos.chat/api/setup.sh
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI entrypoint starts a daemon when the user runs the package binary.
- Log shipping is enabled by default and selects a package-controlled Aliyun endpoint unless disabled.
- The daemon attaches persistent owner and device identifiers to shipped log records and posts batches to that endpoint.
- An owner-only engine action downloads a shell script from the package-controlled portal without integrity verification.
- The downloaded text is executed by Bash with the supplied API key and the complete process environment.
Evidence against
- package.json contains no npm preinstall, install, or postinstall lifecycle hook.
- The remote-script path requires a runtime owner action rather than package installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
17 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.506
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg24865patternName = generic_password
severity = medium
line = 24865
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24865Findings
2 Critical12 High5 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
CriticalPrevious Version Dangerous Deltadist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.549.
The versions list below shows the verdict for each recorded version.
- Avoid installing @clawos-dev/clawd@0.2.549. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.