registry / @clawos-dev/clawd / 0.2.592
@clawos-dev/clawd@0.2.592
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 27d ago · by lpm-firewall-aiThis is a user-started Claude session daemon that rewrites its own persona agent files and forwards local Anthropic settings into a guest spawn, which is guarded first-party agent setup rather than an install hook. No hidden exfiltration or unconsented foreign control-surface write was found, so the package should be warned and not blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs the clawd binary or loads the pi MCP bridge extension.
Impact
Persona agent files under the daemon's managed set are replaced, and a local guest receives credentials already stored for Claude Code. No install-time foreign agent hijack or remote payload execution was found.
Mechanism
replaceManagedPath overwrites daemon-managed persona paths, readOwnerCredentials merges ANTHROPIC settings into the guest sandbox, and pi.registerTool adds tools in-process.
AI rationale
This is a user-started Claude session daemon that rewrites its own persona agent files and forwards local Anthropic settings into a guest spawn, which is guarded first-party agent setup rather than an install hook. No hidden exfiltration or unconsented foreign control-surface write was found, so the package should be warned and not blocked.
Evidence
dist/cli.cjsdist/pi-mcp-bridge/extension.cjs~/.claude/settings.jsonCLAUDE.md.mcp.json.claude/skills.claude/agents
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes only the clawd bin at dist/cli.cjs and has no preinstall, install, or postinstall script.
- The daemon replaces persona paths CLAUDE.md, .mcp.json, .claude/skills, .claude/agents, and mcp when it refreshes a persona.
- readOwnerCredentials loads ~/.claude/settings.json and the daemon injects matching owner credentials into the local guest spawn.
- The pi MCP bridge calls pi.registerTool when that extension is loaded.
- The flagged mcp-server hits are schema comments naming CLAUDE.md and .claude/skills, not install-time writes.
Evidence against
- No registry lifecycle hook runs this code during npm install.
- Copied Anthropic settings stay in the local guest spawn rather than being posted to a package-controlled host.
- publish.sh deploys an extension only when a user passes an extension directory, persona root, and env.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
19 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg24996patternName = generic_password
severity = medium
line = 24996
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24996Findings
1 Critical15 High5 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.592.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.592 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.