@nordsym/apiclaw@2.8.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@nordsym/apiclaw@2.8.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/commands/auth.jsView file

14import { randomBytes, createHash } from 'node:crypto'; L15: import { spawn } from 'node:child_process'; L16: import ora from 'ora';

High

Child Process

Package source references child process execution.

dist/cli/commands/auth.jsView on unpkg · L14

12*/ L13: import { createServer } from 'node:http'; L14: import { randomBytes, createHash } from 'node:crypto'; L15: import { spawn } from 'node:child_process'; L16: import ora from 'ora'; ... L20: import { AUTH_LOGIN_COMMAND, FIRST_CALL_CLI, FIRST_CALL_PROMPT } from '../../first-run.js'; L21: const CONVEX_URL = process.env.APICLAW_CONVEX_URL || L22: 'https://adventurous-avocet-799.convex.cloud';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/commands/auth.jsView on unpkg · L12

12*/ L13: import { createServer } from 'node:http'; L14: import { randomBytes, createHash } from 'node:crypto'; L15: import { spawn } from 'node:child_process'; L16: import ora from 'ora'; ... L20: import { AUTH_LOGIN_COMMAND, FIRST_CALL_CLI, FIRST_CALL_PROMPT } from '../../first-run.js'; L21: const CONVEX_URL = process.env.APICLAW_CONVEX_URL || L22: 'https://adventurous-avocet-799.convex.cloud'; ... L25: const PREFERRED_PORT = 41789; L26: function base64url(buf) { L27: return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, ''); ... L41: function openBrowser(url) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/commands/auth.jsView on unpkg · L12

dist/postinstall.jsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L1: #!/usr/bin/env node L2: /** Referenced control path from dist/session.js: L16: if (!fs.existsSync(SESSION_DIR)) { L17: fs.mkdirSync(SESSION_DIR, { mode: 0o700 }); L18: } ... L60: // Migrate to canonical location L61: fs.writeFileSync(SESSION_FILE, JSON.stringify({ ...data, createdAt: data.createdAt || Date.now() }, null, 2), { mode: 0o600 }); L62: return data; ... L83: }; L84: fs.writeFileSync(SESSION_FILE, JSON.stringify(data, null, 2), { L85: mode: 0o600, // Read/write for owner only ... L127: return 'cursor'; L128: if (process.env.CLAUDE_CODE) L129: return 'claude-code'; Write operation from dist/funnel-client.js: L79: if (!fs.existsSync(MARKER_DIR)) L80: fs.mkdirSync(MARKER_

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/postinstall.jsView on unpkg · L1

dist/cli/commands/mcp-install.jsView file

8import { platform, homedir } from 'os'; L9: import { execSync } from 'child_process'; L10: import chalk from 'chalk'; L11: import { AUTH_LOGIN_COMMAND, FIRST_CALL_CLI, completeFirstRunAuth, } from '../../first-run.js'; L12: // Printed next step: npx @nordsym/apiclaw auth login L13: import { authLoginCommand } from './auth.js';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/mcp-install.jsView on unpkg · L8

dist/product-truth.test.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-truth.test.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "@nordsym/apiclaw",

3 "version": "2.8.7",

4 "description": "The Control Plane for AI Agents. Discover 26,619 API definitions, including 689 exact-name source-verified entries. Source verification is not execution. APIClaw inventories 22 managed adapters, with 22 provider rails customer-executable today, plus 1,003 workspace-authenticated public/no-key HTTPS origins. Anonymous keyless proxy stays disabled. Agent-native auth: `apiclaw auth login` opens your browser, signs you in, and writes ~/.apiclaw.toml. Four doors: local MCP, CLI, HTTP gateway, Remote MCP.",

5 "type": "module",

6 "main": "dist/index.js",

7 "homepage": "https://apiclaw.cloud",

8 "repository": {

9 "type": "git",

10 "url": "https://github.com/nordsym/apiclaw"

11 },

12 "bugs": {

13 "url": "https://github.com/nordsym/apiclaw/issues"

14 },

15 "files": [

16 "dist/"

17 ],

18 "scripts": {

19 "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && ./node_modules/.bin/tsc && chmod +x dist/bin.js",

20 "prepublishOnly": "npm run build",

21 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "dev": "tsx watch src/index.ts",

23 "start": "node dist/index.js",

24 "test": "tsx src/test.ts && tsx src/first-run.test.ts && tsx src/funnel.test.ts && tsx src/product-truth.test.ts && tsx src/workspace-public-apis.test.ts && tsx src/apilayer-customer-rails.test.ts && tsx src/version-trap.test.ts && tsx src/mcp-scope-policy.test.ts && tsx src/trust-floor.test.ts && tsx src/provider-boundaries.test.ts && tsx src/gateway-client.test.ts && tsx src/cli/commands/direct.test.ts && tsx src/chainExecutor.test.ts && tsx src/capability-router.test.ts && tsx landing/src/lib/provider-boundaries.test.ts && tsx landing/src/lib/workspace-truth.test.ts && tsx landing/src/l ...

25 "audit:managed-providers": "node scripts/audit-managed-providers.mjs",

26 "test:e2e": "tsx src/test.ts",

27 "webhook": "tsx src/webhook.ts",

28 "convex:dev": "npx convex dev",

29 "convex:deploy": "find convex -maxdepth 1 \\( -name '*.js' -o -name '*.js.map' -o -name '*.d.ts' -o -name

30 },

31 "keywords": [

32 "mcp",

33 "model-context-protocol",

34 "ai-agent",

35 "ai-agents",

36 "claude",

37 "gpt",

38 "llm",

39 "api",

40 "api-gateway",

41 "api-discovery",

Long lines were clipped for display.

dist/cli/commands/auth.jsView file

Lines 1-34javascript

1/**

2 * APIClaw CLI auth — browser-loopback flow (Modal/gh/vercel pattern).

3 *

4 * `apiclaw auth login`

5 * 1. Generate PKCE verifier + challenge, random state.

6 * 2. Start ephemeral HTTP listener on an OS-assigned port.

7 * 3. POST cliAuth:start to Convex → get {authId, browserUrl}.

8 * 4. Open browserUrl in default browser (open / xdg-open / start).

9 * 5. Wait for /callback?code=X&state=Y on loopback (max 5 min).

10 * 6. Validate state, POST cliAuth:exchange with {code, codeVerifier} → session+key.

dist/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

3 * APIClaw Postinstall Hook

4 * Prints a welcome message with links and fires ONE anonymous funnel

5 * event (install) so we can measure top-of-funnel truthfully.

6 *

7 * Disable telemetry: APICLAW_TELEMETRY=false

8 */

9import { emitFunnelEvent, hasLocalMarker, setLocalMarker } from './funnel-client.js';

dist/cli/commands/mcp-install.jsView file

Lines 1-28javascript

1/**

2 * MCP Install Command

3 * Simple, focused command to install APIClaw into MCP config files

4 * Supports Claude Desktop and Claude Code

5 */

6import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';

7import { dirname, join } from 'path';

dist/product-truth.test.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/product-truth.test.jsView on unpkg