registry / @clawos-dev/clawd / 0.2.598
@clawos-dev/clawd@0.2.598
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 26d ago · by lpm-firewall-aiThis is first-party agent setup: daemon startup overwrites the package's own persona MCP and instruction files, including a GitHub Copilot MCP declaration. It is not an unconsented npm install hook or a hidden exfiltration chain, so it warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
User launches the clawd daemon, which calls refreshDaemonManagedDirs during startup.
Impact
A daemon restart can replace the operator's persona MCP and instruction files with the package's current defaults, including declared GitHub and local MCP servers that expect host-supplied credentials.
Mechanism
For each already-created bundled persona, the daemon removes and recopies DAEMON_MANAGED_PATHS, including MCP config and Claude instruction files, from persona-defaults.
AI rationale
This is first-party agent setup: daemon startup overwrites the package's own persona MCP and instruction files, including a GitHub Copilot MCP declaration. It is not an unconsented npm install hook or a hidden exfiltration chain, so it warrants a warning rather than a publish block.
Evidence
dist/cli.cjsdist/persona-defaults/persona-app-builder/.mcp.jsonpackage.json.mcp.jsonCLAUDE.md.claude/skills.claude/agentsextension-kitmcp
Network endpoints1
api.githubcopilot.com/mcp/
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Daemon startup calls refreshDaemonManagedDirs, which deletes and recopies managed persona files into existing persona directories.
- Managed paths include .mcp.json, CLAUDE.md, .claude/skills, .claude/agents, extension-kit, and mcp.
- The shipped persona-app-builder MCP config declares a GitHub Copilot HTTP server with a bearer token placeholder plus local stdio MCP servers.
- package.json only publishes a clawd bin entry and build/test scripts; it has no preinstall, install, or postinstall hook and no runtime self-dependency.
Evidence against
- The overwrite runs only after the user starts the clawd daemon, not during npm install.
- Copies stay inside this package's own persona directories and only when those directories already exist.
- Agent-integration hits in the bundled MCP servers are deploy schema comments about persona-relative CLAUDE.md paths, not install-time foreign config writes.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Source & flagged code
18 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg25006patternName = generic_password
severity = medium
line = 25006
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L25006Findings
14 High5 Medium6 Low
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.598.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.598 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.