Loading npm security reports…

@clawos-dev/clawd@0.2.506: Malicious npm security report (Block) | LPM Firewall

registry / @clawos-dev/clawd / 0.2.506

@clawos-dev/clawd@0.2.506

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 24d ago · by lpm-firewall-ai

The package seeds an agent persona that solicits an API credential, writes it into a generated project, and sends it to a hard-coded raw-IP endpoint. TLS verification is disabled for that request path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user creates and runs a Dataclaw-builder project or publishes one.

Impact

A user-supplied API credential can be exposed to an unauthenticated, certificate-unverified remote service.

Mechanism

Agent-directed credential collection followed by Bearer-token transmission to a fixed endpoint.

Attack narrative

When the bundled Dataclaw-builder persona is used, it directs the agent to ask for a credential and save it in the generated project's server/.env. The generated server then sends that value as a Bearer token to a fixed raw-IP HTTPS service, while globally disabling TLS certificate verification. Publishing also reads and exports the same credential for deployment.

AI rationale

This is a concrete credential-collection and transmission chain to a hard-coded raw-IP endpoint with TLS verification disabled. The lack of an npm lifecycle hook limits installation risk but does not neutralize the runtime credential-exfiltration behavior.

Evidence

dist/persona-defaults/persona-dataclaw-builder/CLAUDE.mddist/persona-defaults/persona-dataclaw-builder/extension-kit/hooks/pre-deploy.shdist/persona-defaults/persona-dataclaw-builder/extension-kit/examples/nestjs-react/server/src/dataclaw/dataclaw.client.ts<projectDir>/server/.env

Source & flagged code

13 flagged · loading source

dist/app-builder-plugin/mcp-server.cjsView file

21120var import_node_fs = require("fs"); L21121: var import_node_child_process = require("child_process"); L21122: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21120

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.487 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.487 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6946: peerDeviceId: external_exports.string().min(1).optional(), L6947: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6948: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

6946peerDeviceId: external_exports.string().min(1).optional(), L6947: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6948: command: external_exports.string().min(1),

High

Shell

Package source references shell execution.

dist/cli.cjsView on unpkg · L6946

36815if (typeof callback !== "function") { L36816: callback = new Function("" + callback); L36817: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36815

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ else if (c.auth === "oauth" && c.kind === "env") out.push(`\u8FDE\u63A5\u5668 ${c.name} \u662F\u8FDB\u7A0B\u578B\uFF08stdio MCP / CLI\uFF09\uFF0C\u53EA\u80FD\u7C98\u8D34 API key\uF... // persona 目录内的相对路径（'CLAUDE.md' / '.claude/skills/foo/SKILL.md'） httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触发 ReAuth 不强踢 WS（spec §11 第 4 条） */ summary: "\u56DE\u6EDA\u9884\u89C8\uFF1A\u8BFB ~/.claude/file-history \u5FEB\u7167 + \u78C1\u76D8\u73B0\u72B6\u7B97\u771F\u5B9E diff\uFF0C\u4E0D\u4F9D\u8D56

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6946: peerDeviceId: external_exports.string().min(1).optional(), L6947: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6948: command: external_exports.string().min(1),

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

430Cross-file remote execution chain: dist/cli.cjs spawns dist/app-builder-plugin/mcp-server.cjs; helper contains network access plus dynamic code execution. L430: issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6946: peerDeviceId: external_exports.string().min(1).optional(), L6947: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6948: command: external_exports.string().min(1),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L430

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 2562 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/deploy-kit/scripts/publish.shView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.487 matchedPath = dist/deploy-kit/scripts/publish.sh matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.487 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.shView on unpkg

dist/deploy-kit/scripts/publish.spec.tsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.487 matchedPath = dist/deploy-kit/scripts/publish.spec.ts matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.487 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deploy-kit/scripts/publish.spec.tsView on unpkg

dist/dispatch/mcp-server.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.487 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.487 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg