registry / @clawos-dev/clawd / 0.2.579
@clawos-dev/clawd@0.2.579
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package has a concrete first-party agent-extension setup path that automatically equips its own launched sessions with a privileged local MCP server. Static inspection found no npm lifecycle attack or evidence of credential export to an unrelated endpoint.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Starting the clawd daemon and launching a Claude session through it.
Impact
A daemon-launched agent gains the package's local MCP capabilities; this is a guarded agent-extension lifecycle risk rather than confirmed malicious behavior.
Mechanism
The daemon writes a local stdio MCP configuration containing its bearer token, then supplies that file to spawned Claude processes.
AI rationale
The package has a concrete first-party agent-extension setup path that automatically equips its own launched sessions with a privileged local MCP server. Static inspection found no npm lifecycle attack or evidence of credential export to an unrelated endpoint.
Evidence
dist/cli.cjs
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The command-line entry point is the bundled CLI, with no install lifecycle hook declared.
- Daemon startup creates a dispatch MCP configuration containing a daemon bearer token and records it for use.
- The generated configuration runs the package's dispatch server as a local stdio MCP server.
- Claude launches receive every registered MCP configuration through the mcp-config flag.
- Channel extension installation verifies a SHA-256 digest and rejects unsafe archive paths before extracting.
Evidence against
- No automatic npm preinstall, install, or postinstall behavior was found.
- The observed MCP configuration is package-owned and injected into sessions launched by this daemon, not written to a global agent configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
18 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg24884patternName = generic_password
severity = medium
line = 24884
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24884Findings
14 High5 Medium6 Low
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.579.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.579 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.