@myclaw163/clawclaw-cli@0.8.21: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@myclaw163/clawclaw-cli@0.8.21: Suspicious npm security report | LPM Firewall

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/enable_ccl_permissions.cjsView file

12L13: const fs = require("fs"); L14: const os = require("os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/enable_ccl_permissions.cjsView on unpkg · L12

src/runtime/clawclaw/plugins/mailbox/adapters/game-sync-perception-report-adapter.tsView file

9const GAME_SYNC_PERCEPTION_REPORT_BATCH_SIZE = 20; L10: const PERCEPTION_REPORT_UUID_NAMESPACE = Buffer.from( L11: '[redacted]', ... L57: L58: private stopped = false; L59: ... L92: const batch = reports.slice(index, index + GAME_SYNC_PERCEPTION_REPORT_BATCH_SIZE); L93: if (!this.options.send(batch)) { L94: this.options.diagnostic?.('runtime.mailbox.perception_report_dropped', {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/clawclaw/plugins/mailbox/adapters/game-sync-perception-report-adapter.tsView on unpkg · L9

scripts/sync-bundled-skill.mjsView file

1import { L2: cpSync, L3: existsSync, L4: mkdirSync, L5: readFileSync, ... L27: const homeDir = homedir(); L28: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homeDir, '.claude'); L29: const codexHome = process.env.CODEX_HOME?.trim() || join(homeDir, '.codex'); L30: return [ L31: join(homeDir, '.agents', 'skills', SKILL_NAME), L32: join(claudeHome, 'skills', SKILL_NAME), ... L42: try {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/sync-bundled-skill.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = scripts/sync-bundled-skill.mjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-bundled-skill.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @myclaw163/clawclaw-cli@0.8.12 matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.12 similarity = 0.542 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

scripts/find-hide-spots.pyView file

•path = scripts/find-hide-spots.py kind = build_helper sizeBytes = 6479 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/find-hide-spots.pyView on unpkg

src/runtime/clawclaw/plugins/behavior/behavior-source.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/runtime/clawclaw/plugins/behavior/behavior-source.ts#virtual:normalized:round1View on unpkg

scripts/enable_monitor.cjsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = scripts/enable_monitor.cjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/enable_monitor.cjsView on unpkg

scripts/check_monitor.cjsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = scripts/check_monitor.cjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check_monitor.cjsView on unpkg

src/commands/setup/codex.tsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = src/commands/setup/codex.ts matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/setup/codex.tsView on unpkg

scripts/sync-frontend-map.mjsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = scripts/sync-frontend-map.mjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-frontend-map.mjsView on unpkg

src/runtime/clawclaw/plugins/behavior/thread-behavior-executor.tsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = [redacted]-behavior-executor.ts matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/clawclaw/plugins/behavior/thread-behavior-executor.tsView on unpkg

src/runtime/clawclaw/plugins/behavior/behavior-analysis-thread-host.tsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = [redacted]-analysis-thread-host.ts matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/clawclaw/plugins/behavior/behavior-analysis-thread-host.tsView on unpkg

src/runtime/clawclaw/plugins/trigger/trigger-thread-pool.tsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = [redacted]-thread-pool.ts matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/clawclaw/plugins/trigger/trigger-thread-pool.tsView on unpkg

src/runtime/clawclaw/plugins/trigger/trigger-thread-worker.tsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.17 matchedPath = [redacted]-thread-worker.ts matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/clawclaw/plugins/trigger/trigger-thread-worker.tsView on unpkg