registry / @clawos-dev/clawd / 0.2.593

@clawos-dev/clawd@0.2.593

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 27d ago · by lpm-firewall-ai

This is a real, configuration-gated agent extension capability with dynamic tool registration. Static inspection found no concrete malicious install hook, exfiltration sink, or broad foreign agent configuration mutation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Starting the Pi extension with configured MCP paths.

Impact

Configured MCP capabilities become available to the Pi agent; this is a guarded agent-extension capability rather than a confirmed attack.

Mechanism

The extension loads configured MCP definitions, lists remote or local server tools, and registers wrappers in Pi.

AI rationale

Evidence

dist/pi-mcp-bridge/extension.cjsdist/cli.cjs

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package metadata exposes a CLI and has no install lifecycle hook.
The Pi extension loads MCP definitions from configured paths and process context.
It connects to configured MCP servers, obtains their tools, and registers them with Pi.
The CLI seeds package-owned persona sandbox settings.

Evidence against

No install-time execution, secret export, or unconsented broad agent-configuration write was identified in the inspected sources.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 13.2 MB of source, external domains: 120.48.21.36, 127.0.0.1, api.clawos.chat, api.ftp-master.debian.org, api.github.com, api.ttcadvisory.com, app.ttcadvisory.com, clawd-prod.cn-hangzhou.log.aliyuncs.com, cpa-portal-d417.app.clawos.chat, cpa.example.com, github.com, json-schema.org, radix-ui.com, raw.githubusercontent.com, reactjs.org, stuk.github.io, www.w3.org

Source & flagged code

19 flagged

dist/app-builder-plugin/mcp-server.cjsView file

21117var import_node_fs = require("fs"); L21118: var import_node_child_process = require("child_process"); L21119: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

24996patternName = generic_password severity = medium line = 24996

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24996

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L7179: peerDeviceId: external_exports.string().min(1).optional(), L7180: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */ L7181: command: external_exports.string().min(1),

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

37031if (typeof callback !== "function") { L37032: callback = new Function("" + callback); L37033: }

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L37031

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: baseUrl: channel.baseUrl, baseUrl: external_exports.string().min(1), baseUrl: external_exports.string().min(1), baseUrl: external_exports.string().min(1), /** 完整 URL（含 httpBaseUrl 前缀），UI 直接 window.open / 复制到剪贴板 */ else if (c2.auth === "oauth" && c2.kind === "env") out.push(`\u8FDE\u63A5\u5668 ${c2.name} \u662F\u8FDB\u7A0B\u578B\uFF08stdio MCP / CLI\uFF09\uFF0C\u53EA\u80FD\u7C98\u8D34 API key... // persona 目录内的相对路径（'CLAUDE.md' / '.claude/skills/foo/SKILL.md'） const n2 = [ENGINE_AUTH_SECRETS.baseUrl, ENGINE_AUTH_SECRETS.apiKey].filter(has).length;

High

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView file

•path = dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 2562 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView on unpkg

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.shView on unpkg

dist/pi-mcp-bridge/extension.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/pi-mcp-bridge/extension.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pi-mcp-bridge/extension.cjsView on unpkg

dist/dispatch/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

Source & flagged code

19 flagged · loading source

dist/app-builder-plugin/mcp-server.cjsView file

21117var import_node_fs = require("fs"); L21118: var import_node_child_process = require("child_process"); L21119: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

24996patternName = generic_password severity = medium line = 24996

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24996

Findings

1 Critical15 High5 Medium5 Low

CriticalRemote Response Code Executiondist/cli.cjs

HighChild Processdist/app-builder-plugin/mcp-server.cjs

HighEvaldist/cli.cjs

HighCredential Redirect Persistencedist/cli.cjs

HighCommand Output Exfiltrationdist/cli.cjs

HighCross File Remote Execution Contextdist/cli.cjs

HighSemantic Analysis Limiteddist/cli.cjs

HighKnown Malware Source Similaritydist/cli.cjs

HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh

HighKnown Malware Source Similaritydist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh

Affected versions and remediation

This report applies to @clawos-dev/clawd@0.2.593.

See all versions of @clawos-dev/clawd for other recorded verdicts.

Review the evidence and your use of @clawos-dev/clawd@0.2.593 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 07:14:14.650Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.