registry / @clawos-dev/clawd / 0.2.679
@clawos-dev/clawd@0.2.679
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and inspected runtime configuration writes are tied to an active subscription channel. Scanner similarity labels and size limits did not establish malicious behavior in the inspected excerpts.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The CLI is run and a subscription channel is activated; a saved active channel is reapplied when the daemon starts.
Impact
No unauthorized configuration change, credential transfer, or other confirmed attack effect was established.
Mechanism
The CLI writes subscription settings to local agent configuration files and contains rollback snapshots for channel changes.
AI rationale
The manifest has no install lifecycle hook, and inspected runtime configuration writes are tied to an active subscription channel. Scanner similarity labels and size limits did not establish malicious behavior in the inspected excerpts.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and has no install, preinstall, or postinstall hook.
- The flagged CLI location appends a turn-duration record to a Claude session transcript when that file exists.
- Subscription-channel configuration writes are called when a channel is activated, and the active saved channel is reapplied at daemon startup.
- The flagged MCP server locations point to an app-builder collection helper or contain bundled module boilerplate; the inspected excerpts show no attack behavior.
- The flagged guest asset excerpt is minified client-side utility code, not evidence of a package attack.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L30858•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg9420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical10 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.679.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.679 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.