@clawos-dev/clawd@0.2.683
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source supports a warning for default-on operational log egress, including identifiers and potentially sensitive diagnostic text. The scanner’s similarity hints and Claude configuration matches did not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user starts the daemon and it emits log records while shipping is enabled by default.
Impact
Diagnostic content and account or device identifiers may reach the collector; sensitive data included in logs could be exposed.
Mechanism
The CLI forwards log messages and metadata to a batching client, which POSTs records to the configured endpoint. Tool stderr is also logged, limited to 500 characters per line.
AI rationale
The source supports a warning for default-on operational log egress, including identifiers and potentially sensitive diagnostic text. The scanner’s similarity hints and Claude configuration matches did not establish malicious behavior.
Evidence
dist/cli.cjs
Network endpoints1
clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/track
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI; its declared scripts are build, development, type-checking, and test tasks, with no install lifecycle hook.
- The flagged Claude paths show product behavior: the CLI appends turn-duration metadata only to an existing session log, and the plugin references a project collection script in its publish flow.
- Daemon log shipping defaults to on and selects the Clawd Alibaba log endpoint unless disabled or configured off.
- The log client packages records and sends them by POST to its configured endpoint.
- Log records include owner and device identifiers and message text; the CLI also logs up to 500 characters of tool stderr, creating a risk that sensitive diagnostic content is included.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
14 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L30858•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg9420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical10 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.683.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.683 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.