registry / @clawos-dev/clawd / 0.2.681
@clawos-dev/clawd@0.2.681
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package manifest has no install lifecycle hook, and source inspection did not verify credential theft, unconsented agent configuration changes, or another concrete attack. The flagged app-builder copies have identical source hashes, which explains the similarity signal without supporting a malicious verdict.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The CLI or an MCP server is invoked by a user or host application.
Impact
No malicious effect was established from the reviewed source.
Mechanism
The reviewed CLI code appends a session duration record to an existing project transcript; the app-builder code runs a project publishing operation.
AI rationale
The package manifest has no install lifecycle hook, and source inspection did not verify credential theft, unconsented agent configuration changes, or another concrete attack. The flagged app-builder copies have identical source hashes, which explains the similarity signal without supporting a malicious verdict.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the `clawd` CLI and lists build, development, and test scripts; it has no install lifecycle hook.
- The CLI appends a duration record only to an existing Claude project transcript for the specified session.
- The app-builder code handles project publishing; the two persona-default copies have the same source hash as that server file.
- The peer-ops and dispatch files start MCP servers over standard input and output, and the Pi bridge registers tools with the host API.
- The scanner’s high-similarity paths contain ordinary bundled server and extension code; inspection found no concrete attack behavior in the reviewed excerpts.
Evidence against
- Static hints reported source similarity and a dangerous version delta, but those labels did not establish malicious behavior in source. The matching app-builder files are byte-identical copies.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
14 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L30858•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg9420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical10 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.681.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.681 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.