registry / @myclaw163/clawclaw-cli / 0.6.91

@myclaw163/clawclaw-cli@0.6.91

ClawClaw social deduction game CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 202 file(s), 1.03 MB of source, external domains: custom.example, example.com, game.example.com, hub.example, lobby.example, myclaw.163.com, registry.npmmirror.com

Source & flagged code

6 flagged

package.jsonView file

Lines 9-49json

9 },

10 "main": "src/sdk/index.ts",

11 "exports": {

12 ".": "./src/sdk/index.ts",

13 "./sdk": "./src/sdk/index.ts"

14 },

15 "engines": {

16 "node": ">=18.0.0"

17 },

18 "files": [

19 "bin/",

20 "src/",

21 "personas/",

22 "scripts/",

23 "skills/"

24 ],

25 "scripts": {

26 "typecheck": "tsc --noEmit",

27 "test": "vitest run",

28 "test:watch": "vitest",

29 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "release:patch": "npm version patch && npm publish --registry https://registry.npmjs.org --access public",

31 "release:minor": "npm version minor && npm publish --registry https://registry.npmjs.org --access public",

32 "release:major": "npm version major && npm publish --registry https://registry.npmjs.org --access public"

33 },

34 "dependencies": {

35 "commander": "^12.0.0",

36 "esbuild": "~0.28.0",

37 "skills": "1.5.1",

38 "tsx": "^4.0.0",

39 "undici": "^6.21.3",

40 "ws": "^8.16.0"

41 },

42 "devDependencies": {

43 "@types/node": "^20.0.0",

44 "@types/ws": "^8.5.10",

45 "typescript": "^5.4.0",

46 "vitest": "^3.1.0"

47 }

48}

scripts/enable_ccl_permissions.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Add ClawClaw ccl commands to Claude Code's permissions.allow list.

4 *

5 * This script intentionally only edits ~/.claude/settings.json permissions.allow.

6 * It does not back up, revert, remove, or rewrite any other settings.

7 *

8 * Usage:

9 * node enable_ccl_permissions.cjs

10 * node enable_ccl_permissions.cjs --dry-run

11 */

src/runtime/owner-control.tsView file

Lines 1-24typescript

1import { createHash, randomBytes } from 'crypto';

2import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'fs';

3import { tmpdir } from 'os';

4import { join } from 'path';

5import { connect, createServer, type Server } from 'net'

scripts/find-hide-spots.pyView file

•path = scripts/find-hide-spots.py kind = build_helper sizeBytes = 6602 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/find-hide-spots.pyView on unpkg

src/strategies/strategy-loop.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @myclaw163/clawclaw-cli@0.6.94 matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.6.94 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/strategies/strategy-loop.tsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/enable_ccl_permissions.cjsView file

12L13: const fs = require("fs"); L14: const os = require("os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/enable_ccl_permissions.cjsView on unpkg · L12

src/runtime/owner-control.tsView file

4import { join } from 'path'; L5: import { connect, createServer, type Server } from 'net'; L6: ... L45: try { L46: return JSON.parse(readFileSync(runtimePath, 'utf8')); L47: } catch {} ... L52: const hash = createHash('sha1').update(stateDir).digest('hex').slice(0, 12); L53: if (process.platform === 'win32') return `\\\\.\\pipe\\clawclaw-${hash}-${pid}`; L54: const dir = join(tmpdir(), 'clawclaw'); ... L80: if (request.token !== token) { L81: socket.end(JSON.stringify({ ok: false, error: 'invalid_token' }) + '\n'); L82: return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/owner-control.tsView on unpkg · L4

scripts/find-hide-spots.pyView file

•path = scripts/find-hide-spots.py kind = build_helper sizeBytes = 6602 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/find-hide-spots.pyView on unpkg

src/strategies/strategy-loop.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/strategies/strategy-loop.tsView on unpkg

Findings

2 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltasrc/strategies/strategy-loop.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/enable_ccl_permissions.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/find-hide-spots.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/runtime/owner-control.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

package.jsonView file

Lines 9-49json

9 },

10 "main": "src/sdk/index.ts",

11 "exports": {

12 ".": "./src/sdk/index.ts",

13 "./sdk": "./src/sdk/index.ts"

14 },

15 "engines": {

16 "node": ">=18.0.0"

17 },

18 "files": [

19 "bin/",

20 "src/",

21 "personas/",

22 "scripts/",

23 "skills/"

24 ],

25 "scripts": {

26 "typecheck": "tsc --noEmit",

27 "test": "vitest run",

28 "test:watch": "vitest",

29 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "release:patch": "npm version patch && npm publish --registry https://registry.npmjs.org --access public",

31 "release:minor": "npm version minor && npm publish --registry https://registry.npmjs.org --access public",

32 "release:major": "npm version major && npm publish --registry https://registry.npmjs.org --access public"

33 },

34 "dependencies": {

35 "commander": "^12.0.0",

36 "esbuild": "~0.28.0",

37 "skills": "1.5.1",

38 "tsx": "^4.0.0",

39 "undici": "^6.21.3",

40 "ws": "^8.16.0"

41 },

42 "devDependencies": {

43 "@types/node": "^20.0.0",

44 "@types/ws": "^8.5.10",

45 "typescript": "^5.4.0",

46 "vitest": "^3.1.0"

47 }

48}

scripts/enable_ccl_permissions.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Add ClawClaw ccl commands to Claude Code's permissions.allow list.

4 *

5 * This script intentionally only edits ~/.claude/settings.json permissions.allow.

6 * It does not back up, revert, remove, or rewrite any other settings.

7 *

8 * Usage:

9 * node enable_ccl_permissions.cjs

10 * node enable_ccl_permissions.cjs --dry-run

11 */

src/runtime/owner-control.tsView file

Lines 1-24typescript

1import { createHash, randomBytes } from 'crypto';

2import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'fs';

3import { tmpdir } from 'os';

4import { join } from 'path';

5import { connect, createServer, type Server } from 'net'

scripts/find-hide-spots.pyView file

•path = scripts/find-hide-spots.py kind = build_helper sizeBytes = 6602 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/find-hide-spots.pyView on unpkg

src/strategies/strategy-loop.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/strategies/strategy-loop.tsView on unpkg