@clawos-dev/clawd@0.2.705
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe inspected source confirms default-on runtime disclosure of log records and account/device identifiers to a fixed collector, with opt-out controls and partial redaction. This is a privacy risk, but the source does not establish a concrete malicious attack warranting a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user starts the clawd daemon without disabling log shipping or setting its mode to off.
Impact
Operational log content and identifying account and device data leave the machine; the opt-out and partial metadata redaction reduce but do not remove this privacy risk.
Mechanism
The logger batches messages and metadata into JSON and posts the records to the configured endpoint, which defaults to the package's fixed collector.
AI rationale
The inspected source confirms default-on runtime disclosure of log records and account/device identifiers to a fixed collector, with opt-out controls and partial redaction. This is a privacy risk, but the source does not establish a concrete malicious attack warranting a publish block.
Evidence
dist/cli.cjs
Network endpoints1
clawd-prod.cn-hangzhou.log.aliyuncs.com/logstores/app-logs/track
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes dist/cli.cjs as the clawd command.
- Daemon startup passes account and device identifiers into the log client.
- Log shipping defaults to on and uses a fixed collector unless disabled or overridden.
- The logger forwards message text and other metadata; records include account and device identifiers and are sent in HTTP POST requests.
- Shipping can be disabled, and metadata redaction targets token- and password-like key names.
Evidence against
- The observed transfer is runtime logging, not an install-time disclosure; the source provides a disable flag and redacts some metadata, but does not establish that all log content is sensitive.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
15 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L308589420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
High
Eval
Package source references dynamic code evaluation.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L9420•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical12 High4 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/app-builder-plugin/mcp-server.cjs
HighSame File Env Network Executiondist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.705.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.705 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.