@drakon-systems/agent-optimizer@0.12.0: Suspicious npm security

Loading npm security reports…

@drakon-systems/agent-optimizer@0.12.0: Suspicious npm security | LPM Firewall

dist/auditors/openclaw/security-scan.jsView file

Lines 1-35javascript

1import { readdirSync, readFileSync, existsSync, statSync } from "fs";

2import { join, resolve, basename } from "path";

3import chalk from "chalk";

4import { expandPath, loadConfig, findWorkspace } from "../../utils/config.js";

5const SUSPICIOUS_PATTERNS = [

6 // Billing / payment

7 { pattern: /skillpay/i, label: "SkillPay billing integration", severity: "high", category: "billing" },

8 { pattern: /billing[._]charge/i, label: "Billing charge call", severity: "high", category: "billing" },

9 { pattern: /payment_url|payment.link|paymentIntent/i, label: "Payment URL/intent generation", severity: "high", category: "billing" },

10 { pattern: /api\/v1\/billing|\/billing\/charge/i, label: "Billing API endpoint", severity: "high", category: "billing" },

11 { pattern: /\.charge\s*\(/i, label: "Charge function call", severity: "high", category: "billing" },

12 { pattern: /stripe\.com|stripe\.checkout/i, label: "Stripe payment integration", severity: "medium", category: "billing" },

13 { pattern: /cryptocurrency|usdt|bitcoin|ethereum|web3|0x[a-fA-F0-9]{40}/i, label: "Cryptocurrency/wallet reference", severity: "high", category: "billing" },

14 { pattern: /gumroad|lemonSqueezy|paddle\.com|buymeacoffee/i, label: "Payment platform integration", severity: "medium", category: "billing" },

15 // Code injection

16 { pattern: /eval\s*\(/, label: "eval() usage", severity: "high", category: "injection" },

17 { pattern: /new\s+Function\s*\(/, label: "Dynamic function constructor", severity: "high", category: "injection" },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/auditors/openclaw/security-scan.jsView on unpkg · L15

18 { pattern: /child_process/, label: "child_process module", severity: "medium", category: "injection" },

19 { pattern: /exec\s*\(\s*['"`]/, label: "Shell command execution with string", severity: "high", category: "injection" },

20 { pattern: /execSync\s*\(/, label: "Synchronous shell execution", severity: "medium", category: "injection" },

21 { pattern: /spawn\s*\(\s*['"`](?!node|npm|npx|python|pip)/, label: "Process spawn (non-standard binary)", severity: "medium", category: "injection" },

22 { pattern: /\.replace\s*\(.*\bFunction\b/, label: "String-to-function conversion", severity: "high", category: "injection" },

23 { pattern: /vm\.runIn(New|This)Context/i, label: "VM context execution", severity: "high", category: "injection" },

24 // Data exfiltration / network

25 { pattern: /fetch\s*\(\s*['"`]https?:\/\/(?!api\.(openai|anthropic|google|x\.ai|deepseek|openrouter))/i, label: "HTTP call to non-standard endpoint", severity: "medium", category: "exfiltration" },

26 { pattern: /XMLHttpRequest/i, label: "XMLHttpRequest usage", severity: "medium", category: "exfiltration" },

27 { pattern: /urllib\.request|requests\.post|requests\.get/i, label: "Python HTTP library", severity: "low", category: "exfiltration" },

28 { pattern: /axios\s*\.\s*(get|post|put|delete)\s*\(/i, label: "Axios HTTP call", severity: "low", category: "exfiltration" },

29 { pattern: /webhook|ngrok|localtunnel|serveo/i, label: "Tunnel/webhook service", severity: "medium", category: "exfiltration" },

30 { pattern: /telemetry|analytics|tracking|mixpanel|segment\.io|posthog/i, label: "Telemetry/analytics", severity: "medium", category: "exfiltration" },

31 { pattern: /navigator\.sendBeacon/i, label: "Beacon API (silent data send)", severity: "high", category: "exfiltration" },

32 // Obfuscation

33 { pattern: /atob\s*\(|btoa\s*\(|Buffer\.from\s*\(\s*['"][A-Za-z0-9+/=]{50,}/, label: "Base64 encode/decode (long string)", severity: "medium", category: "obfuscation" },

34 { pattern: /\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){10,}/, label: "Hex-encoded string sequence", severity: "high", category: "obfuscation" },

35 { pattern: /\\u[0-9a-fA-F]{4}(?:\\u[0-9a-fA-F]{4}){10,}/, label: "Unicode-encoded string sequence", severity: "high", category: "obfuscation" },

dist/cli.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import { runFullAudit } from "./auditors/index.js";

5import { generateReport, printBanner, printScanResults } from "./reporters/index.js";

6import { enrollMonitor, runMonitor, monitorStatus, disableMonitor, testMonitor, installCronOnly, } from "./monitor/index.js";

7import { loadLicense, saveLicense, removeLicense, getLicensePath, validateLicense, canUseFleet, PRICING, } from "./licensing/index.js";

8import { createRequire } from "module";

9const require = createRequire(import.meta.url);

10const { version } = require("../package.json");

11const program = new Command();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L9

12program

13 .name("agent-optimizer")

14 .description("OpenClaw Agent Optimizer by Drakon Systems — audit, optimize, and secure your OpenClaw deployment")

15 .version(version)

16 .addHelpText("before", () => {

17 const r = chalk.red;

18 const w = chalk.bold.white;

19 const d = chalk.dim;

20 return [

21 "",

22 r(" 🦞 ") + w("AGENT OPTIMIZER") + d(` v${version}`),

23 d(" ─────────────────────────────"),

24 "",

25 d(" FREE"),

26 ` ${w("audit")} ${d("[-c config] [--json] [--deep]")} ${d("Full 70+ check audit")}`,

27 ` ${w("scan")} ${d("[-c config] [--workspace path]")} ${d("Malware + billing scan")}`,

28 ` ${w("optimize --dry-run")} ${d("[--profile name]")} ${d("Preview optimizations")}`,

29 ` ${w("drift")} ${d("[--name snapshot]")} ${d("Config drift detection")}`,

Lines 201-241javascript

201});

202program

203 .command("update")

204 .description("Check for updates and install the latest version")

205 .action(async () => {

206 printBanner();

207 console.

@drakon-systems/agent-optimizer@0.12.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code