Loading npm security reports…

@drakon-systems/agent-optimizer: Suspicious npm security report | LPM Firewall

registry / @drakon-systems/agent-optimizer / 0.12.0

@drakon-systems/agent-optimizer@0.12.0

Audit, optimize, and secure OpenClaw AI agent deployments. Token waste detection, security scanning, config drift, fleet SSH audit. Free to install.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 79 file(s), 437 KB of source, external domains: api.openai.com, drakonsystems.com

Source & flagged code

4 flagged

dist/detect/index.jsView file

Lines 1-21javascript

1import { existsSync } from "fs";

2import { execSync } from "child_process";

3import { homedir } from "os";

High

Child Process

Package source references child process execution.

dist/detect/index.jsView on unpkg · L1

4import { resolve } from "path";

5import { detectOpenClawVersion } from "../utils/config.js";

6function detectClaudeCodeVersion() {

7 try {

8 const out = execSync("claude --version 2>/dev/null", {

9 timeout: 3000,

10 encoding: "utf-8",

11 }).toString().trim();

12 const m = out.match(/(\d+\.\d+\.\d+(?:-[\w.]+)?)/);

13 return m ? m[1] : null;

14 }

15 catch {

16 return null;

17 }

18}

19export function detectSystems(cwd = process.cwd()) {

20 const systems = [];

21 // Claude Code — user scope

dist/auditors/openclaw/security-scan.jsView file

Lines 1-35javascript

1import { readdirSync, readFileSync, existsSync, statSync } from "fs";

2import { join, resolve, basename } from "path";

3import chalk from "chalk";

4import { expandPath, loadConfig, findWorkspace } from

dist/cli.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import { runFullAudit } from "./auditors/index.js";

5import { generateReport, printBanner, printScanResults } from

Source & flagged code

4 flagged · loading source

dist/detect/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code