registry / @clawos-dev/clawd / 0.2.547

@clawos-dev/clawd@0.2.547

⚠ Under review

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 22 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 11.1 MB of source, external domains: 120.48.21.36, 127.0.0.1, api.clawos.chat, api.github.com, api.ttcadvisory.com, app.ttcadvisory.com, clawd-prod.cn-hangzhou.log.aliyuncs.com, cpa-portal-d417.app.clawos.chat, github.com, json-schema.org, radix-ui.com, raw.githubusercontent.com, reactjs.org, stuk.github.io, www.w3.org

Source & flagged code

15 flagged

dist/app-builder-plugin/mcp-server.cjsView file

21116var import_node_fs = require("fs"); L21117: var import_node_child_process = require("child_process"); L21118: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21116

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.506 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

24861patternName = generic_password severity = medium line = 24861

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24861

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6966: peerDeviceId: external_exports.string().min(1).optional(), L6967: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6968: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

36739if (typeof callback !== "function") { L36740: callback = new Function("" + callback); L36741: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36739

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ else if (c2.auth === "oauth" && c2.kind === "env") out.push(`\u8FDE\u63A5\u5668 ${c2.name} \u662F\u8FDB\u7A0B\u578B\uFF08stdio MCP / CLI\uFF09\uFF0C\u53EA\u80FD\u7C98\u8D34 API key... // persona 目录内的相对路径（'CLAUDE.md' / '.claude/skills/foo/SKILL.md'） /** 官方 provider 没有 baseUrl（config.model_providers 只含用户自定义的） */ provider: external_exports.object({ name: external_exports.string(), baseUrl: external_exports.string().optional() }).strict(), httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/deploy-kit/scripts/verify.shView file

•path = dist/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 2562 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/deploy-kit/scripts/verify.shView on unpkg

dist/pi-mcp-bridge/extension.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.506 matchedPath = dist/pi-mcp-bridge/extension.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pi-mcp-bridge/extension.cjsView on unpkg

dist/dispatch/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/deploy-kit/scripts/publish.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @clawos-dev/clawd@0.2.539 matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.539 similarity = 0.907 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/deploy-kit/scripts/publish.shView on unpkg

Source & flagged code

15 flagged · loading source

dist/app-builder-plugin/mcp-server.cjsView file

21116var import_node_fs = require("fs"); L21117: var import_node_child_process = require("child_process"); L21118: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21116

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

24861patternName = generic_password severity = medium line = 24861

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24861

Findings

2 Critical10 High5 Medium5 Low

CriticalRemote Response Code Executiondist/cli.cjs

CriticalPrevious Version Dangerous Deltadist/deploy-kit/scripts/publish.sh

HighChild Processdist/app-builder-plugin/mcp-server.cjs

HighEvaldist/cli.cjs

HighCredential Redirect Persistencedist/cli.cjs

HighCommand Output Exfiltrationdist/cli.cjs

HighCross File Remote Execution Contextdist/cli.cjs

HighSemantic Analysis Limiteddist/cli.cjs

HighKnown Malware Source Similaritydist/cli.cjs

HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs

HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs

Affected versions and remediation

This report applies to @clawos-dev/clawd@0.2.547.

See all versions of @clawos-dev/clawd for other recorded verdicts.

Review the evidence and your use of @clawos-dev/clawd@0.2.547 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 07:04:38.893Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.