registry / @clawos-dev/clawd / 0.2.656
@clawos-dev/clawd@0.2.656
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe inspected runtime paths show user-invoked project tooling and package-configured diagnostics, with no concrete malicious chain. The dynamic-code matches are bundled validator and compatibility routines, and package.json declares no install lifecycle hook.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The user starts the daemon while log shipping is enabled.
Impact
The collector receives diagnostics and device and owner identifiers; inspected source showed no credential theft or unconsented agent control-surface mutation.
Mechanism
The daemon posts diagnostic records to its configured collector; shipping can be disabled, and sensitive-key metadata is redacted.
AI rationale
The inspected runtime paths show user-invoked project tooling and package-configured diagnostics, with no concrete malicious chain. The dynamic-code matches are bundled validator and compatibility routines, and package.json declares no install lifecycle hook.
Network endpoints1
clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/track
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and build, development, and test scripts; it declares no install lifecycle hook.
- The Claude session hint returns if the existing transcript is absent and otherwise appends a turn-duration record.
- The three app-builder copies use the hinted Claude skill path for publishing through a registered MCP tool; this is explicit project tooling.
- The Pi bridge reads MCP definitions from caller-provided config paths, the dispatch server starts only as a direct entrypoint, and the guest UI maps attachment URLs to the daemon host.
- The dynamic-code sites are bundled routines that compile generated validator code or convert a callback in a timer-compatibility shim.
- The daemon sends diagnostic records and owner/device identifiers to its configured ClawOS collector by default; it supports disabling shipping and redacts sensitive-key metadata.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
15 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L308589420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
High
Eval
Package source references dynamic code evaluation.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L9420•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical12 High4 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.656.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.656 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.