Loading npm security reports…

@clawos-dev/clawd@0.2.364: Malicious npm security report (Block) | LPM Firewall

registry / @clawos-dev/clawd / 0.2.364

@clawos-dev/clawd@0.2.364

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 3h ago · by lpm-firewall-ai

When the clawd daemon creates a Claude guest session for another principal, it reads the local owner's Claude settings and passes Anthropic credentials or an API-key helper into that guest process. This grants a remote guest-triggered agent access to the owner's AI credentials.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs clawd and a non-owner principal creates a persona-backed Claude session.

Impact

A guest-controlled Claude process can use the owner's Anthropic credentials or API-key helper; default telemetry also sends logs externally.

Mechanism

Harvests local Claude credentials and injects them into remote-guest agent spawns.

Attack narrative

The CLI has no install hook, but its normal daemon flow reads ~/.claude/settings.json, extracts ANTHROPIC_* values and apiKeyHelper, and merges them into Claude settings for sessions whose creator is not the owner. That explicitly transfers the owner's credentials to a remote guest-triggered agent process. The guest work-directory sandbox does not prevent this credential delegation.

Rationale

This is concrete, unconsented credential delegation from a foreign Claude configuration into guest-controlled agent sessions. The absence of lifecycle hooks does not mitigate the runtime credential-exposure chain.

Evidence

package.jsondist/cli.cjs~/.claude/settings.json~/.clawd/

Network endpoints1

clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/track

Source & flagged code

14 flagged · loading source

dist/dispatch/mcp-server.cjsView file

21112// src/tools/claude.ts L21113: var import_node_child_process = require("child_process"); L21114: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L21112

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.299 matchedPath = dist/inbox/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.299 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6520: peerDeviceId: external_exports.string().min(1).optional(), L6521: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6522: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

35640if (typeof callback !== "function") { L35641: callback = new Function("" + callback); L35642: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L35640

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触发 ReAuth 不强踢 WS（spec §11 第 4 条） */ summary: "\u56DE\u6EDA\u9884\u89C8\uFF1A\u8BFB ~/.claude/file-history \u5FEB\u7167 + \u78C1\u76D8\u73B0\u72B6\u7B97\u771F\u5B9E diff\uFF0C\u4E0D\u4F9D\u8D56 CC \u8FDB\u7A0B", const base = args.baseDir ?? import_node_path5.default.join(import_node_os3.default.homedir(), ".claude"); // CC 的文件快照备份根：~/.claude/file-history/<toolSessionId>/<hash>@v<n> const base = opts.baseDir ?? import_node_path5.default.jo

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.cjs: // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js "../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js"() { // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js "../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js"() { // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js "../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js"() { // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js "../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js"() {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.cjsView on unpkg

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6520: peerDeviceId: external_exports.string().min(1).optional(), L6521: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6522: command: external_exports.string().min(1),

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

430Cross-file remote execution chain: dist/cli.cjs spawns dist/peer-ops/mcp-server.cjs; helper contains network access plus dynamic code execution. L430: issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6520: peerDeviceId: external_exports.string().min(1).optional(), L6521: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6522: command: external_exports.string().min(1),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.299 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.299 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 005a0ae5eadb72c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @clawos-dev/clawd@0.2.299 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.299 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.cjsView on unpkg

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/deploy-kit/scripts/publish.spec.tsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.299 matchedPath = dist/deploy-kit/scripts/publish.spec.ts matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.299 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.spec.tsView on unpkg

dist/deploy-kit/scripts/publish.shView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.299 matchedPath = dist/deploy-kit/scripts/publish.sh matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.299 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.shView on unpkg