registry / @clawos-dev/clawd / 0.2.686
@clawos-dev/clawd@0.2.686
⚠ Under reviewStandalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected source supports normal CLI, publish, session-history, and MCP integration behavior, and does not establish malicious activity. The large bundled runtime is not fully resolved, so the package needs manual review rather than a clean verdict.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The package exposes a CLI; the inspected helper runs during an app-builder publish operation, and the session-file update is called through a daemon runner.
Impact
No confirmed attack effect was identified; the unresolved runtime behavior prevents a clean conclusion.
Mechanism
The inspected agent-related locations construct a skill path, append a session duration record, or register configured MCP tools. The reviewed excerpts do not establish unconsented agent configuration changes or credential transfer.
AI rationale
The inspected source supports normal CLI, publish, session-history, and MCP integration behavior, and does not establish malicious activity. The large bundled runtime is not fully resolved, so the package needs manual review rather than a clean verdict.
Decision evidence
public snapshotAI called this Manual Review at 73.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a CLI and has no install lifecycle hook.
- The app-builder bundles construct a Claude skill helper path; their publish flow runs that helper as part of a publish operation.
- The CLI target resolves a Claude project session file and appends a turn-duration record through its runner.
- The Pi bridge loads configured MCP servers and registers their tools; the inspected peer-ops and dispatch bundles connect MCP servers over standard input and output.
- The guest asset makes its fetch with browser credentials omitted.
- Some runtime behavior in the large bundled files remains unresolved.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L30858•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg9420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical10 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.686.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.686 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.