registry / @clawos-dev/clawd / 0.2.553
@clawos-dev/clawd@0.2.553
⚠ Under reviewStandalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspection found no lifecycle hook or concrete malicious behavior. A clean verdict cannot be source-cited across all nine mandated paths within the eight-citation schema limit.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs the clawd CLI and an authorized guest sends a peerExec request.
Impact
An authorized remote contact can execute commands as the daemon user; no covert installation-time execution, credential export, or unrelated exfiltration was confirmed.
Mechanism
The daemon passes the requested command to a shell only after checking the caller's contact record for remote access permission.
AI rationale
Inspection found no lifecycle hook or concrete malicious behavior. A clean verdict cannot be source-cited across all nine mandated paths within the eight-citation schema limit.
Decision evidence
public snapshotAI called this Manual Review at 83.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest has a CLI entrypoint and no install lifecycle script.
- The active CLI starts its daemon only when the clawd command is invoked.
- Remote shell execution is limited to a guest contact explicitly marked for remote access.
- Extension bundles are hash-checked and reject path-traversal entries before extraction.
- The flagged MCP bundles contain AJV schema compilation code; this alone is not proof of payload execution.
- A clean finding would require nine distinct required-path citations, but the schema permits only eight.
Evidence against
- The daemon includes a remote-command feature, so its security depends on its authentication and contact authorization model.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
19 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg24874patternName = generic_password
severity = medium
line = 24874
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24874Findings
1 Critical15 High5 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.553.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.553 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.