Loading npm security reports…

@clawos-dev/clawd@0.2.435: Suspicious npm security report (Warn) | LPM Firewall

registry / @clawos-dev/clawd / 0.2.435

@clawos-dev/clawd@0.2.435

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 7h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Invoking the clawd CLI creates and refreshes package-owned AI personas with permissive sandbox profiles. Its bundled app-builder template can transmit a user-supplied bearer key to a fixed endpoint with TLS validation disabled.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs the clawd CLI and later uses its generated data-query application or publish workflow.

Impact

A generated agent or application can receive broad file, command, and network capability; supplied service or cloud credentials may be exposed to configured external services.

Mechanism

First-party agent persona provisioning with permissive controls and credential-bearing deployment templates.

Rationale

The package is not confirmed malware because no lifecycle trigger, self-dependency chain, or remote payload execution was found. It is nevertheless a high-risk first-party AI-agent extension with permissive defaults and credential-handling templates.

Evidence

dist/cli.cjsdist/persona-defaults/persona-dataclaw-builder/extension-kit/examples/nestjs-react/server/src/dataclaw/dataclaw.client.tsdist/deploy-kit/scripts/publish.sh~/.clawd/personas/~/.s/access.yaml<project>/server/.env<project>/ext.conf

Network endpoints1

Source & flagged code

13 flagged · loading source

dist/dispatch/mcp-server.cjsView file

21112// src/tools/claude.ts L21113: var import_node_child_process = require("child_process"); L21114: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L21112

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/dispatch/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6575: peerDeviceId: external_exports.string().min(1).optional(), L6576: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6577: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

36247if (typeof callback !== "function") { L36248: callback = new Function("" + callback); L36249: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36247

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触发 ReAuth 不强踢 WS（spec §11 第 4 条） */ summary: "\u56DE\u6EDA\u9884\u89C8\uFF1A\u8BFB ~/.claude/file-history \u5FEB\u7167 + \u78C1\u76D8\u73B0\u72B6\u7B97\u771F\u5B9E diff\uFF0C\u4E0D\u4F9D\u8D56 CC \u8FDB\u7A0B", const base = args.baseDir ?? import_node_path5.default.join(import_node_os3.default.homedir(), ".claude"); // CC 的文件快照备份根：~/.claude/file-history/<toolSessionId>/<hash>@v<n> const base = opts.baseDir ?? import_node_path5.default.jo

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6575: peerDeviceId: external_exports.string().min(1).optional(), L6576: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6577: command: external_exports.string().min(1),

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

430Cross-file remote execution chain: dist/cli.cjs spawns dist/dispatch/mcp-server.cjs; helper contains network access plus dynamic code execution. L430: issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6575: peerDeviceId: external_exports.string().min(1).optional(), L6576: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6577: command: external_exports.string().min(1),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 005a0ae5eadb72c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.cjsView on unpkg

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/deploy-kit/scripts/publish.spec.tsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/deploy-kit/scripts/publish.spec.ts matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.spec.tsView on unpkg

dist/deploy-kit/scripts/publish.shView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/deploy-kit/scripts/publish.sh matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.shView on unpkg

Source & flagged code

13 flagged

dist/dispatch/mcp-server.cjsView file

21112// src/tools/claude.ts L21113: var import_node_child_process = require("child_process"); L21114: var import_node_child_process2 = require("child_process");

High

Child Process

Package source references child process execution.

dist/dispatch/mcp-server.cjsView on unpkg · L21112

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/dispatch/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6575: peerDeviceId: external_exports.string().min(1).optional(), L6576: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6577: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

36247if (typeof callback !== "function") { L36248: callback = new Function("" + callback); L36249: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36247

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触发 ReAuth 不强踢 WS（spec §11 第 4 条） */ summary: "\u56DE\u6EDA\u9884\u89C8\uFF1A\u8BFB ~/.claude/file-history \u5FEB\u7167 + \u78C1\u76D8\u73B0\u72B6\u7B97\u771F\u5B9E diff\uFF0C\u4E0D\u4F9D\u8D56 CC \u8FDB\u7A0B", const base = args.baseDir ?? import_node_path5.default.join(import_node_os3.default.homedir(), ".claude"); // CC 的文件快照备份根：~/.claude/file-history/<toolSessionId>/<hash>@v<n> const base = opts.baseDir ?? import_node_path5.default.jo

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6575: peerDeviceId: external_exports.string().min(1).optional(), L6576: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6577: command: external_exports.string().min(1),

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

430Cross-file remote execution chain: dist/cli.cjs spawns dist/dispatch/mcp-server.cjs; helper contains network access plus dynamic code execution. L430: issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6575: peerDeviceId: external_exports.string().min(1).optional(), L6576: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6577: command: external_exports.string().min(1),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 005a0ae5eadb72c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.cjsView on unpkg

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1679 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/deploy-kit/scripts/publish.spec.tsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/deploy-kit/scripts/publish.spec.ts matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.spec.tsView on unpkg

dist/deploy-kit/scripts/publish.shView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.364 matchedPath = dist/deploy-kit/scripts/publish.sh matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.shView on unpkg