registry / @clawos-dev/clawd / 0.2.644
@clawos-dev/clawd@0.2.644
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe manifest has no npm lifecycle hook, and the inspected flagged paths resolve to package features that run through the CLI or project tools. The source excerpts provide no verified malicious credential transfer or unconsented control-surface change.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user invokes the CLI or an available MCP tool.
Impact
The inspected behavior does not establish install-time mutation, unconsented agent configuration changes, credential disclosure, or destructive action.
Mechanism
The CLI writes a turn-duration record to an existing session file; app-builder publishing runs a project collector after checking project state.
AI rationale
The manifest has no npm lifecycle hook, and the inspected flagged paths resolve to package features that run through the CLI or project tools. The source excerpts provide no verified malicious credential transfer or unconsented control-surface change.
Evidence
.claude/projects/<cwd-hash>/<tool-session-id>.jsonl
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and lists build, development, and test scripts; the inspected entrypoint starts the daemon when invoked.
- The CLI appends a turn-duration record only to an existing Claude session file.
- The app-builder bundles use a project-specific collector in a publish flow, and the CLI entrypoint exposes normal command-line startup.
- The guest interface fetches a supplied URL with browser credentials omitted.
- The Pi bridge loads tools from configured MCP links, and the dispatch bundle registers a persona-dispatch tool.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
15 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L308589420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
High
Eval
Package source references dynamic code evaluation.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L9420•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical12 High4 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.644.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.644 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.