Loading npm security reports…

@clawos-dev/clawd@0.2.549: Malicious npm security report (Block) | LPM Firewall

registry / @clawos-dev/clawd / 0.2.549

@clawos-dev/clawd@0.2.549

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Running the daemon transmits log records with persistent identifiers to an external default endpoint. The owner-only pool action fetches and executes unverified remote shell code with the caller's key and inherited environment.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run clawd for telemetry; invoke engine:connectPool for remote code execution.

Impact

A remote portal response can execute arbitrary commands and access the process environment; runtime logs are sent externally by default.

Mechanism

Default log exfiltration and unverified remote shell execution.

Attack narrative

The package starts a daemon whose default configuration enables external log shipping. More seriously, its engine pool feature fetches a shell script from a package-controlled portal as plain text and pipes it to Bash. It passes the caller-provided API key and inherits the entire daemon environment, with no signature, checksum, or allowlisted command set. A compromised or malicious portal response can therefore run arbitrary commands and extract available credentials when an owner invokes that feature.

AI rationale

The unverified remote-script execution is a concrete remote-code-execution path, and the daemon also sends identified logs to a default external endpoint. Absence of an npm lifecycle hook limits installation-time impact but does not neutralize the runtime attack behavior.

Evidence

dist/cli.cjs

Network endpoints2

clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/track/api/setup.sh

Source & flagged code

17 flagged · loading source

dist/app-builder-plugin/mcp-server.cjsView file

21117var import_node_fs = require("fs"); L21118: var import_node_child_process = require("child_process"); L21119: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.506 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

24865patternName = generic_password severity = medium line = 24865

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24865

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6969: peerDeviceId: external_exports.string().min(1).optional(), L6970: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6971: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

36742if (typeof callback !== "function") { L36743: callback = new Function("" + callback); L36744: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36742

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ else if (c2.auth === "oauth" && c2.kind === "env") out.push(`\u8FDE\u63A5\u5668 ${c2.name} \u662F\u8FDB\u7A0B\u578B\uFF08stdio MCP / CLI\uFF09\uFF0C\u53EA\u80FD\u7C98\u8D34 API key... // persona 目录内的相对路径（'CLAUDE.md' / '.claude/skills/foo/SKILL.md'） /** 官方 provider 没有 baseUrl（config.model_providers 只含用户自定义的） */ provider: external_exports.object({ name: external_exports.string(), baseUrl: external_exports.string().optional() }).strict(), httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView file

•path = dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 2562 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView on unpkg

dist/pi-mcp-bridge/extension.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.506 matchedPath = dist/pi-mcp-bridge/extension.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pi-mcp-bridge/extension.cjsView on unpkg

dist/dispatch/mcp-server.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.506 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.506 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.506 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.506 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @clawos-dev/clawd@0.2.539 matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.539 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView on unpkg