@clawos-dev/clawd@0.2.555
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe code establishes a real remote-code-execution capability on a user-triggered path. It is not enough to prove malware intent or justify an install-time block, but it is unsafe enough to warn.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
An engine:connectPool RPC request with an API key.
Impact
A compromised or changed portal response can run arbitrary commands under the invoking user's privileges and access the supplied key and inherited environment.
Mechanism
The handler fetches /api/setup.sh from the pool portal and pipes its contents to Bash, exposing the supplied API key to that script.
AI rationale
The code establishes a real remote-code-execution capability on a user-triggered path. It is not enough to prove malware intent or justify an install-time block, but it is unsafe enough to warn.
Evidence
dist/cli.cjs
Network endpoints1
cpa-portal-d417.app.clawos.chat/api/setup.sh
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI downloads a shell script from a package-controlled portal without an integrity or signature check.
- It passes the downloaded response directly to Bash, with the caller-provided pool API key placed in that process environment.
- The engine RPC handler accepts an API key and invokes that remote-script path.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The risky path is an engine connection action, not automatic installation-time execution.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
19 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg24903patternName = generic_password
severity = medium
line = 24903
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24903Findings
1 Critical15 High5 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.555.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.555 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.