Loading npm security reports…

@clawos-dev/clawd@0.2.458: Malicious npm security report (Block) | LPM Firewall

registry / @clawos-dev/clawd / 0.2.458

@clawos-dev/clawd@0.2.458

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A bundled agent persona solicits a user API credential and places it in a generated project. The generated backend sends it to a fixed IP while TLS verification is disabled.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user starts clawd, creates a DataClaw builder project, and supplies the requested API key.

Impact

The supplied API credential can be exposed to the fixed endpoint or intercepted because certificate verification is disabled.

Mechanism

Agent-directed credential collection and transmission to a fixed unverified HTTPS endpoint.

Attack narrative

After the user invokes the daemon and creates the bundled DataClaw project, its agent instructions request an API key and direct the agent to save it in server/.env with a fixed IP service URL. The generated backend disables TLS verification and uses that value as a Bearer credential for requests to the fixed endpoint. This exposes a user-supplied credential outside a verified service identity.

Rationale

The package contains a concrete credential-collection and transmission path to a fixed IP with certificate verification disabled. The lack of an install hook does not neutralize the user-invoked malicious credential flow.

Evidence

dist/persona-defaults/persona-dataclaw-builder/CLAUDE.mddist/persona-defaults/persona-dataclaw-builder/extension-kit/examples/nestjs-react/server/src/dataclaw/dataclaw.config.tsdist/persona-defaults/persona-dataclaw-builder/extension-kit/examples/nestjs-react/server/src/dataclaw/dataclaw.client.ts

Source & flagged code

12 flagged · loading source

dist/app-builder-plugin/mcp-server.cjsView file

21119var import_node_fs = require("fs"); L21120: var import_node_child_process = require("child_process"); L21121: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21119

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.436 matchedPath = dist/dispatch/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.436 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6756: peerDeviceId: external_exports.string().min(1).optional(), L6757: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6758: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

36557if (typeof callback !== "function") { L36558: callback = new Function("" + callback); L36559: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36557

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ // persona 目录内的相对路径（'CLAUDE.md' / '.claude/skills/foo/SKILL.md'） httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触发 ReAuth 不强踢 WS（spec §11 第 4 条） */ summary: "\u56DE\u6EDA\u9884\u89C8\uFF1A\u8BFB ~/.claude/file-history \u5FEB\u7167 + \u78C1\u76D8\u73B0\u72B6\u7B97\u771F\u5B9E diff\uFF0C\u4E0D\u4F9D\u8D56 CC \u8FDB\u7A0B", const base = args.baseDir ?? import_node_path5.default.join(import_node_os3.default.homedir(), ".claude"); // CC 的文件快照备份根：~/.claude/file-history/<toolSessionId>/<has

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6756: peerDeviceId: external_exports.string().min(1).optional(), L6757: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6758: command: external_exports.string().min(1),

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

430Cross-file remote execution chain: dist/cli.cjs spawns dist/app-builder-plugin/mcp-server.cjs; helper contains network access plus dynamic code execution. L430: issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6756: peerDeviceId: external_exports.string().min(1).optional(), L6757: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6758: command: external_exports.string().min(1),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.436 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.436 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.cjsView on unpkg

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 2562 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/dispatch/mcp-server.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.436 matchedPath = dist/dispatch/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.436 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/deploy-kit/scripts/publish.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @clawos-dev/clawd@0.2.435 matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.435 similarity = 0.868 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/deploy-kit/scripts/publish.shView on unpkg

Source & flagged code

12 flagged

dist/app-builder-plugin/mcp-server.cjsView file

21119var import_node_fs = require("fs"); L21120: var import_node_child_process = require("child_process"); L21121: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21119

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.436 matchedPath = dist/dispatch/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.436 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6756: peerDeviceId: external_exports.string().min(1).optional(), L6757: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6758: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

36557if (typeof callback !== "function") { L36558: callback = new Function("" + callback); L36559: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36557

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ // persona 目录内的相对路径（'CLAUDE.md' / '.claude/skills/foo/SKILL.md'） httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触发 ReAuth 不强踢 WS（spec §11 第 4 条） */ summary: "\u56DE\u6EDA\u9884\u89C8\uFF1A\u8BFB ~/.claude/file-history \u5FEB\u7167 + \u78C1\u76D8\u73B0\u72B6\u7B97\u771F\u5B9E diff\uFF0C\u4E0D\u4F9D\u8D56 CC \u8FDB\u7A0B", const base = args.baseDir ?? import_node_path5.default.join(import_node_os3.default.homedir(), ".claude"); // CC 的文件快照备份根：~/.claude/file-history/<toolSessionId>/<has

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6756: peerDeviceId: external_exports.string().min(1).optional(), L6757: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6758: command: external_exports.string().min(1),

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

430Cross-file remote execution chain: dist/cli.cjs spawns dist/app-builder-plugin/mcp-server.cjs; helper contains network access plus dynamic code execution. L430: issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6756: peerDeviceId: external_exports.string().min(1).optional(), L6757: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6758: command: external_exports.string().min(1),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.436 matchedPath = dist/cli.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.436 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.cjsView on unpkg

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 2562 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/dispatch/mcp-server.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.436 matchedPath = dist/dispatch/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.436 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/deploy-kit/scripts/publish.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @clawos-dev/clawd@0.2.435 matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.435 similarity = 0.868 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/deploy-kit/scripts/publish.shView on unpkg