registry / @clawos-dev/clawd / 0.2.630
@clawos-dev/clawd@0.2.630
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected agent-related behavior is tied to CLI or publishing operations. Static similarity and evaluation hints did not establish a concrete attack surface in the inspected source.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The CLI is run, or a user invokes the app-builder publishing operation.
Impact
No malicious impact was established from these behaviors.
Mechanism
The publishing path checks repository state and runs a project collection script; the CLI appends a duration record to an existing session log.
AI rationale
The manifest has no install lifecycle hook, and the inspected agent-related behavior is tied to CLI or publishing operations. Static similarity and evaluation hints did not establish a concrete attack surface in the inspected source.
Evidence
dist/cli.cjsdist/app-builder-plugin/mcp-server.cjs
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json declares the CLI as its binary and has no preinstall, install, or postinstall hook.
- The app-builder publishing path reads project state and invokes a project collection script after checking repository state.
- The CLI appends a turn-duration record only when the expected session log exists.
- The other required bundle paths were inspected; their opening bytes show ordinary bundled JavaScript wrappers, and no attack behavior was identified in the inspected evidence.
Evidence against
- Static hints report source similarity and dynamic-code evaluation, but inspection did not establish malicious behavior from those signals.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
15 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkgdist/cli.cjsView file
430issueData,
L431: data: ctx.data,
L432: path: ctx.path,
...
L624: return false;
L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "=");
L626: const decoded = JSON.parse(atob(base64));
...
L4883: * See:
L4884: * https://github.com/colinhacks/zod/issues/2433
L4885: * Fix in Zod:
...
L7137: peerDeviceId: external_exports.string().min(1).optional(),
L7138: /** 交给对端 `bash -c` 的命令；cc 自拼完整路径（一发一收，无跨命令会话状态）。 */
L7139: command: external_exports.string().min(1),
Findings
1 Critical12 High4 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.630.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.630 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.