registry / Remote code execution / @clawos-dev/clawd / 0.2.552

@clawos-dev/clawd@0.2.552

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has no install-time lifecycle hook, but its active daemon contains a guarded arbitrary-command execution path and default external telemetry. These concrete runtime capabilities warrant a warning rather than a publication block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user runs the clawd CLI, enables remote access for a peer contact, or starts the daemon with default log shipping.

Impact

An approved remote contact can execute arbitrary shell commands; daemon log records and device identity can be sent externally.

Mechanism

Authenticated peer Bash execution and default telemetry upload.

AI rationale

Evidence

dist/cli.cjs~/.clawd

Network endpoints1

clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/track

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The executable daemon exposes a peer command feature that runs an input command through Bash in the user's home directory.
A guest peer can reach that command path when the owner has explicitly enabled remote access for that contact.
The daemon enables log shipping by default and posts collected records to a package-controlled Aliyun logging endpoint.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The peer command handler rejects unapproved contacts and requires a guest principal.
The command capability is activated by running the clawd CLI, not by package installation or import.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

20 flagged

dist/app-builder-plugin/mcp-server.cjsView file

21117var import_node_fs = require("fs"); L21118: var import_node_child_process = require("child_process"); L21119: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

24870patternName = generic_password severity = medium line = 24870

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24870

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6969: peerDeviceId: external_exports.string().min(1).optional(), L6970: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L6971: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

36747if (typeof callback !== "function") { L36748: callback = new Function("" + callback); L36749: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L36747

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ else if (c2.auth === "oauth" && c2.kind === "env") out.push(`\u8FDE\u63A5\u5668 ${c2.name} \u662F\u8FDB\u7A0B\u578B\uFF08stdio MCP / CLI\uFF09\uFF0C\u53EA\u80FD\u7C98\u8D34 API key... // persona 目录内的相对路径（'CLAUDE.md' / '.claude/skills/foo/SKILL.md'） /** 官方 provider 没有 baseUrl（config.model_providers 只含用户自定义的） */ provider: external_exports.object({ name: external_exports.string(), baseUrl: external_exports.string().optional() }).strict(), httpBaseUrl: external_exports.string().optional(), /** file-sharing HTTP 路由的 Authorization: Bearer token；与 WS token 解耦，HTTP 401 仅触

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView file

•path = dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 2562 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @clawos-dev/clawd@0.2.539 matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.539 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView on unpkg

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView on unpkg

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView on unpkg

dist/pi-mcp-bridge/extension.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/pi-mcp-bridge/extension.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pi-mcp-bridge/extension.cjsView on unpkg

dist/dispatch/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

Source & flagged code

20 flagged · loading source

dist/app-builder-plugin/mcp-server.cjsView file

21117var import_node_fs = require("fs"); L21118: var import_node_child_process = require("child_process"); L21119: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

24870patternName = generic_password severity = medium line = 24870

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24870

Findings

2 Critical15 High5 Medium5 Low

CriticalRemote Response Code Executiondist/cli.cjs

CriticalPrevious Version Dangerous Deltadist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh

HighChild Processdist/app-builder-plugin/mcp-server.cjs

HighEvaldist/cli.cjs

HighCredential Redirect Persistencedist/cli.cjs

HighCommand Output Exfiltrationdist/cli.cjs

HighCross File Remote Execution Contextdist/cli.cjs

HighSemantic Analysis Limiteddist/cli.cjs

HighKnown Malware Source Similaritydist/cli.cjs

HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh

Affected versions and remediation

This report applies to @clawos-dev/clawd@0.2.552.

See all versions of @clawos-dev/clawd for other recorded verdicts.

Review the evidence and your use of @clawos-dev/clawd@0.2.552 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 02:48:37.349Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.