No confirmed malicious attack surface. The package is a Vite/React UI that talks to the local/configured NextClaw runtime and uses normal browser PWA storage.
Static reason
No blocking static signals were detected.
Trigger
User opens or builds/runs the UI application.
Impact
No credential harvesting, install-time mutation, persistence beyond browser PWA cache, or exfiltration found.
Mechanism
React UI network client and PWA cache management
Rationale
Source inspection shows a normal NextClaw UI package with no npm lifecycle execution and network behavior aligned to local/configured NextClaw services. Suspicious primitives are browser/PWA and app-client plumbing, not concrete attack behavior.
Evidence
package.jsonsrc/main.tsxsrc/app/index.tsxsrc/shared/lib/transport/app-client.service.tssrc/shared/lib/transport/local-transport.service.tssrc/shared/lib/transport/remote-transport.service.tssrc/shared/lib/api/api-base.tssrc/features/panel-apps/managers/panel-app-bridge.manager.tspublic/sw.jsindex.htmlvite.config.tsREADME.md