Loading npm security reports…

@clawos-dev/clawd: Suspicious npm security report (Warn) | LPM Firewall

registry / @clawos-dev/clawd / 0.2.243

@clawos-dev/clawd@0.2.243

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 6.56 MB of source, external domains: 120.48.21.36, 127.0.0.1, app.ttcadvisory.com, fetch.spec.whatwg.org, github.com, json-schema.org, mimesniff.spec.whatwg.org, radix-ui.com, raw.githubusercontent.com, reactjs.org, spec.openapis.org, stackoverflow.com, tools.ietf.org, webidl.spec.whatwg.org, www.safaribooksonline.com, www.w3.org

Oversized source lightweight scan

dist/cli.cjs2.18 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStrings127.0.0.1

Source & flagged code

7 flagged

dist/dispatch/mcp-server.cjsView file

39524// src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L39524

39511const json = serializeMessage(message); L39512: if (this._stdout.write(json)) { L39513: resolve(); ... L39521: // src/dispatch/mcp-server.ts L39522: var import_undici = __toESM(require_undici(), 1); L39523: L39524: // src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dispatch/mcp-server.cjsView on unpkg · L39511

dist/peer-ops/mcp-server.cjsView file

2943sourceCode = this.opts.code.process(sourceCode, sch); L2944: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2945: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/peer-ops/mcp-server.cjsView on unpkg · L2943

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/cli.cjsView file

•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 2284779 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg

•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 2284779 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/dispatch/mcp-server.cjsView file

39524// src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L39524

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dispatch/mcp-server.cjsView on unpkg · L39511

dist/peer-ops/mcp-server.cjsView file

Findings

4 High5 Medium6 Low

HighChild Processdist/dispatch/mcp-server.cjs

HighShell

HighCommand Output Exfiltrationdist/dispatch/mcp-server.cjs

HighOversized Source Filedist/cli.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/deploy-kit/scripts/verify.sh

MediumOversized Cli Entrypointdist/cli.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/peer-ops/mcp-server.cjs

LowWeak Cryptodist/peer-ops/mcp-server.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/dispatch/mcp-server.cjsView file

39524// src/tools/claude.ts L39525: var import_node_child_process = require("child_process"); L39526: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L39524

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dispatch/mcp-server.cjsView on unpkg · L39511

dist/peer-ops/mcp-server.cjsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/peer-ops/mcp-server.cjsView on unpkg · L2943

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/cli.cjsView file

•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 2284779 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg

•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 2284779 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg