Loading npm security reports…

@clawos-dev/clawd@0.2.221: Clean npm security report (Allow) | LPM Firewall

registry / @clawos-dev/clawd / 0.2.221

@clawos-dev/clawd@0.2.221

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 4.97 MB of source, external domains: 120.48.21.36, 127.0.0.1, app.ttcadvisory.com, fetch.spec.whatwg.org, github.com, json-schema.org, mimesniff.spec.whatwg.org, radix-ui.com, raw.githubusercontent.com, reactjs.org, spec.openapis.org, stackoverflow.com, tools.ietf.org, webidl.spec.whatwg.org, www.safaribooksonline.com, www.w3.org

Oversized source lightweight scan

dist/cli.cjs2.21 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStrings127.0.0.1

Source & flagged code

5 flagged

dist/inbox/mcp-server.cjsView file

2943sourceCode = this.opts.code.process(sourceCode, sch); L2944: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2945: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/inbox/mcp-server.cjsView on unpkg · L2943

dist/dispatch/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dispatch/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/cli.cjsView file

•path = dist/cli.cjs kind = oversized_source_file sizeBytes = 2313708 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.cjsView on unpkg

•path = dist/cli.cjs kind = oversized_cli_entrypoint sizeBytes = 2313708 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.cjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/inbox/mcp-server.cjsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/inbox/mcp-server.cjsView on unpkg · L2943

dist/dispatch/mcp-server.cjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dispatch/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.sh

Findings

1 High5 Medium6 Low

HighOversized Source Filedist/cli.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/deploy-kit/scripts/verify.sh

MediumOversized Cli Entrypointdist/cli.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/inbox/mcp-server.cjs

LowWeak Cryptodist/dispatch/mcp-server.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings