registry  /  @myclaw163/clawclaw-cli  /  0.6.81

@myclaw163/clawclaw-cli@0.6.81

ClawClaw social deduction game CLI

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 193 file(s), 935 KB of source, external domains: example.com, game.example.com, hub.example, myclaw.163.com, registry.npmmirror.com

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
src/strategies/loader.tsView file
37* L38: * `require()` calls fail the build with a clear error, since `require` is L39: * unavailable in ESM output and would otherwise crash at runtime.
Medium
Dynamic Require

Package source references dynamic require/import behavior.

src/strategies/loader.tsView on unpkg · L37
src/runtime/owner-control.tsView file
4import { join } from 'path'; L5: import { connect, createServer, type Server } from 'net'; L6: ... L45: try { L46: return JSON.parse(readFileSync(runtimePath, 'utf8')); L47: } catch {} ... L52: const hash = createHash('sha1').update(stateDir).digest('hex').slice(0, 12); L53: if (process.platform === 'win32') return `\\\\.\\pipe\\clawclaw-${hash}-${pid}`; L54: const dir = join(tmpdir(), 'clawclaw'); ... L80: if (request.token !== token) { L81: socket.end(JSON.stringify({ ok: false, error: 'invalid_token' }) + '\n'); L82: return;
Low
Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/owner-control.tsView on unpkg · L4
scripts/find-hide-spots.pyView file
•path = scripts/find-hide-spots.py kind = build_helper sizeBytes = 6445 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/find-hide-spots.pyView on unpkg

Findings

1 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiresrc/strategies/loader.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/find-hide-spots.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/runtime/owner-control.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License