registry / Credential exfiltration / @clawos-dev/clawd / 0.2.652

@clawos-dev/clawd@0.2.652

Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Guest runners receive the owner’s Anthropic credentials without a credential-specific consent check, creating conditional exposure to guest-controlled prompts. Public-persona and send-grant checks restrict access, but do not establish consent to share those credentials; direct exfiltration is not shown.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A guest with send access dispatches a task to a public persona.

Impact

The guest-controlled agent may use or expose credentials belonging to the owner.

Mechanism

The daemon reads the owner’s Anthropic environment entries and API key helper, merges them into guest settings, and passes those settings to Claude.

AI rationale

Evidence

dist/cli.cjs

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Guest Claude setup reads the owner’s settings and selects string-valued Anthropic environment entries and an API key helper.
Guest Claude runner setup merges those credentials into its settings, which are passed to Claude as command-line settings.
A guest dispatch carries the guest’s prompt into a guest runner; dispatch requires a public persona and a send grant.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 14.1 MB of source, external domains: 120.48.21.36, 127.0.0.1, api-int.clawos.chat, api.clawos.chat, api.ftp-master.debian.org, api.github.com, api.ttcadvisory.com, app.ttcadvisory.com, clawd-prod.cn-hangzhou.log.aliyuncs.com, cpa-portal-d417.app.clawos.chat, cpa.example.com, github.com, json-schema.org, persona-int.clawos.chat, persona.clawos.chat, radix-ui.com, raw.githubusercontent.com, reactjs.org, stuk.github.io, www.w3.org

Source & flagged code

15 flagged

dist/app-builder-plugin/mcp-server.cjsView file

30858var import_node_fs = require("fs"); L30859: var import_node_child_process = require("child_process"); L30860: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L30858

9420if (typeof callback !== "function") { L9421: callback = new Function("" + callback); L9422: }

High

Eval

Package source references dynamic code evaluation.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L9420

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/app-builder-plugin/mcp-server.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjsView on unpkg

dist/peer-ops/mcp-server.cjsView file

1227// validation function arguments L1228: data: new codegen_1.Name("data"), L1229: // data passed to validation function ... L2254: id = normalizeId(id); L2255: return resolver.resolve(baseId, id); L2256: } ... L3117: for (i = 0; i < input.length; i++) { L3118: code = input[i].charCodeAt(0); L3119: if (code === 48) { ... L8886: * @type {-2|-1|0|1} L8887: * @private L8888: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/peer-ops/mcp-server.cjsView on unpkg · L1227

dist/cli.cjsView file

430issueData, L431: data: ctx.data, L432: path: ctx.path, ... L624: return false; L625: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L626: const decoded = JSON.parse(atob(base64)); ... L4883: * See: L4884: * https://github.com/colinhacks/zod/issues/2433 L4885: * Fix in Zod: ... L6229: status: external_exports.literal("passed"), L6230: exitCode: external_exports.literal(0), L6231: result: external_exports.object({

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.cjsView on unpkg · L430

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: baseUrl: channel.baseUrl, baseUrl: external_exports.string().min(1), baseUrl: external_exports.string().min(1), baseUrl: external_exports.string().min(1), else if (c2.auth === "oauth" && c2.kind === "env") out.push(`\u8FDE\u63A5\u5668 ${c2.name} \u662F\u8FDB\u7A0B\u578B\uFF08stdio MCP / CLI\uFF09\uFF0C\u53EA\u80FD\u7C98\u8D34 API key... const n2 = [ENGINE_AUTH_SECRETS.baseUrl, ENGINE_AUTH_SECRETS.apiKey].filter(has).length; function normalizeEngineBaseUrl(raw) { ENGINE_AUTH_SECRETS = { baseUrl: "CLAWD_ENGINE_BASE_URL", apiKey: "CLAWD_ENGINE_API_KEY" };

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView file

•path = dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.sh kind = build_helper sizeBytes = 1577 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/verify.shView on unpkg

dist/pi-mcp-bridge/extension.cjsView file

•matchType = normalized_sha256 matchedPackage = @clawos-dev/clawd@0.2.549 matchedPath = dist/pi-mcp-bridge/extension.cjs matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pi-mcp-bridge/extension.cjsView on unpkg

dist/dispatch/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dispatch/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/mcp-server.cjsView on unpkg

Source & flagged code

15 flagged · loading source

dist/app-builder-plugin/mcp-server.cjsView file

30858var import_node_fs = require("fs"); L30859: var import_node_child_process = require("child_process"); L30860: var import_node_path = require("path");

High

Child Process

Package source references child process execution.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L30858

9420if (typeof callback !== "function") { L9421: callback = new Function("" + callback); L9422: }

High

Eval

Package source references dynamic code evaluation.

dist/app-builder-plugin/mcp-server.cjsView on unpkg · L9420

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app-builder-plugin/mcp-server.cjs

Findings

1 Critical12 High4 Medium5 Low

CriticalRemote Response Code Executiondist/cli.cjs

HighChild Processdist/app-builder-plugin/mcp-server.cjs

HighEvaldist/app-builder-plugin/mcp-server.cjs

HighCredential Redirect Persistencedist/cli.cjs

HighCommand Output Exfiltrationdist/cli.cjs

HighCross File Remote Execution Contextdist/cli.cjs

HighSemantic Analysis Limiteddist/cli.cjs

HighKnown Malware Source Similaritydist/cli.cjs

HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs

HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs

HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs

Affected versions and remediation

This report applies to @clawos-dev/clawd@0.2.652.

See all versions of @clawos-dev/clawd for other recorded verdicts.

Review the evidence and your use of @clawos-dev/clawd@0.2.652 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 08:05:49.235Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.