registry / @okki-global/okki-claw / 1.3.1-beta

@okki-global/okki-claw@1.3.1-beta

Node.js sidecar that bridges local OpenClaw gateway to the agent-relay cloud relay.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `okki-claw`/the sidecar daemon after pairing.

Impact

A configured relay can access the local agent gateway under the paired device and gateway credentials; this is an explicit but high-impact remote-agent capability.

Mechanism

Authenticated WebSocket relay bridge to a local OpenClaw gateway.

Rationale

No concrete malicious chain was found, but the package deliberately creates a persistent authenticated relay path to a local AI-agent gateway and can self-update. Treat it as a warning-worthy, user-invoked agent capability rather than malware.

Evidence

package.jsonREADME.mddist/main.jsdist/chunk-BUKVIEU7.jsdist/index.d.ts~/.agent-relay/config.json~/.openclaw/openclaw.json

Network endpoints2

agent-relay.okki.comlocalhost:18799

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/chunk-BUKVIEU7.js` reads the OpenClaw gateway token/config and maintains a relay tunnel.
Pairing sends a supplied token to `https://agent-relay.okki.com/api/devices/complete-pairing` and persists relay credentials.
Daemon mode optionally self-updates with `npm install -g @okki-global/okki-claw@<latest>`.
CLI includes explicit agent process termination commands.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` hook.
The manifest, README, and runtime consistently describe a user-invoked OpenClaw-to-relay sidecar.
Config writes are limited to the package-owned `~/.agent-relay/config.json` with restrictive permissions.
No source evidence of hidden exfiltration, foreign AI-agent config mutation, or remote shell payload execution.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 271 KB of source, external domains: 127.0.0.1, agent-relay.okki.com

Source & flagged code

3 flagged

dist/chunk-BUKVIEU7.jsView file

Lines 1-21javascript

1import{execFile as Ro}from"child_process";import{readFile as Po}from"fs/promises";import{dirname as Io,join as Gn}from"path";import{fileURLToPath as Eo}from"url";import{promisify as To}from"util";var Oo=To(Ro),xo="@okki-global/okki-claw";async function Wt(){try{let t=Eo(import.meta.url),e=Gn(Io(t),".."),n=Gn(e,"package.json"),s=await Po(n,"utf-8");return JSON.parse(s).version}catch{return}}async function Uo(t={}){let e=t.packageName??xo,[n,s]=await Promise.all([Wt(),Do(e,t.npmCommand,t.commandRunner)]);return{packageName:e,currentVersion:n,latestVersion:s,updateAvailable:!!(n&&s&&No(s,n)>0)}}a ...

2Set OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN to override`)}let n;try{n=JSON.parse(e)}catch{throw new Error(`Invalid JSON in ${t.openclawConfigPath}`)}let s=n.gateway,r=s?.port??3e3,o=s?.auth?.token;console.log(`[discoverOpenClaw] parsed config file: gateway.port=${r} gateway.auth.token=${o?o.slice(0,8)+"...":"NOT_FOUND"}`);let i=t.openclawGatewayHost||"localhost",a=t.openclawGatewayPort??r,d=t.openclawGatewayToken||o;if(console.log(`[discoverOpenClaw] final resolution: host=${i} port=${a} token=${d?d.slice

3Set OPENCLAW_GATEWAY_TOKEN to override`);return{url:`http://${i}:${a}`,token:d}}async function ci(t){try{return(await fetch(`${t.url}/health`,{headers:{Authorization:`Bearer ${t.token}`},signal:AbortSignal.timeout(5e3)})).ok}catch{return!1}}function ms(t,e,n){let s=e.healthCheckIntervalSec*1e3;return setInterval(async()=>{await ci(t)||n()},s)}import di from"ws";var li="CONTROL_UI_ORIGIN_REJECTED",gs="CONTROL_UI_UPGRADE_FAILED",Ge=class{tunnelClient;socketFactory;controlUIConfig;sockets=new Map;constructor(e,n,s,r=(o,i)=>new di(o,i)){let o=s?.baseURL??"http://localhost:18799";this.controlUIConf ...

4`),{id:s,promise:r,cancel:i=>{let a=this.pendingRequests.get(s);a&&(this.pendingRequests.delete(s),a.reject(i))}}}sendNotification(e,n){if(!this.proc)throw new Error("ACP client not started");this.logRequest(e,n);let s={jsonrpc:"2.0",method:e,params:n};L("send_notification",{method:e,params:n,pendingRequests:this.pendingRequests.size}),this.proc.stdin.write(`${JSON.stringify(s)}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-BUKVIEU7.jsView on unpkg · L1

5`)}logRequest(e,n){if(e==="session/set_config_option"){console.info(`ACP request method=session/set_config_option session=${qs(String(n.sessionId??""))} config=${String(n.configId??"")}`);return}(e==="session/resume"||e==="session/prompt")&&console.info(`ACP request method=${e} session=${qs(String(n.sessionId??""))}`)}handleLine(e){let n=e.trim();if(!n)return;let s;try{s=JSON.parse(n)}catch{let r=R(n);L("stdout_fallback",{text:r}),this.options.onFallback?.({kind:"stdout",text:r});return}if(Aa(s),typeof s.method=="string"&&(typeof s.id=="number"||typeof s.id=="string")){this.handleProviderReque ...

6`)}rejectPendingRequests(e){if(this.pendingRequests.size===0)return;let n=new Error(R(e.message));L("reject_pending_requests",{message:n.message,count:this.pendingRequests.size});for(let s of this.pendingRequests.values())s.reject(n);this.pendingRequests.clear()}};function qs(t){let

7`);return r.exitCode===0?fe("available",void 0,Fa(o),$a(t)):xa.test(o)?fe("auth_needed","authenticate"):fe("error","configure")}catch(r){return Wa(r)?fe("not_installed","install"):fe("error","configure")}}function $a(t){return{resume:t==="claude"||t==="opencode"||t==="codex",streaming:!0,toolUse:!0,image:!1}}function fe(t,e,n,s={}){return{supported:!0,availability:t,setupCode:e,version:n,flags:s}}function Fa(t){let e=t.split(`

8`)[0]?.trim();if(e&&!/(token|apikey|api_key|secret|password|authorization|env|credential|path|home|user|stdout|stderr|commandOutput|\/Users\/|\/home\/)/i.test(e))return e.slice(0,120)}function qa(t,e){return new Promise((n,s)=>{let r=Pa(t,e,{env:Ie({...process.env}),stdio:["ignore","pipe","pipe"]}),o="",i="";r.stdout.setEncoding("utf8"),r.stderr.setEncoding("utf8"),r.stdout.on("data",a=>{o+=a}),r.stderr.on("data",a=>{i+=a}),r.on("error",s),r.on("close",a=>{n({exitCode:a??1,stdout:o,stderr:i})})})}function Wa(t){return typeof t=="object"&&t!==null&&"code"in t&&t.code==="ENOENT"}var ot=class{cap ...

9${new Error("stopSession caller").stack}`);let n=this.sessionStarts.get(e);if(n)try{await n}catch{}let s=this.sessions.get(e);if(this.sessionStarts.delete(e),!s){this.emitSessionState(e);return}try{await this.teardownSession(e,s)}finally{this.emitSessionState(e)}}getActiveSessionIds(){return Array.from(this.sessions.keys())}hasActiveSessions(){for(let e of this.sessions.values())if(!kc(e.runtimeStatus))return!0;return!1

10`).trim();if(!r)return null;if(r==="[DONE]")return{kind:"done"};let o=JSON.parse(r);return{kind:"event",eventType:o.type??n,payload:o}}function fr(t){return{model:t?.model,inputTokens:t?.usage?.input_tokens,outputTokens:t?.usage?.output_tokens}}function gn(t,e){let n=t?.response,s=n?.usage,r=

12\u26A0\uFE0F Device identity changed and must be re-approved.

14Copy and paste the following prompt into the OpenClaw chat to re-approve this device:

16\`\`\`

17${u}

18\`\`\``}this.emitTranscript({kind:"result",ts:y(),text:d,subtype:"error",isError:!0,errors:[d]}),this.emitStatus("error",d)}finally{this.activeAbortController===s&&(this.activeAbortController=null)}}async sendPromptViaHttp(e,n,s){let r=new Headers({Accept:"text/event-stream","Content-Type":"application/json",Authorization:`Bearer ${n.token}`

20\u8BF7\u5728 OpenClaw \u4E2D\u5B8C\u6210\u4EE5\u4E0B\u6B65\u9AA4\uFF1A

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/chunk-BUKVIEU7.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-BUKVIEU7.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-BUKVIEU7.jsView on unpkg · L1

1import{execFile as Ro}from"child_process";import{readFile as Po}from"fs/promises";import{dirname as Io,join as Gn}from"path";import{fileURLToPath as Eo}from"url";import{promisify a... L2: Set OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN to override`)}let n;try{n=JSON.parse(e)}catch{throw new Error(`Invalid JSON in ${t.openclawConfigPath}`)}let s=n.gateway,r=s?.po... L3: Set OPENCLAW_GATEWAY_TOKEN to override`);return{url:`http://${i}:${a}`,token:d}}async function ci(t){try{return(await fetch(`${t.url}/health`,{headers:{Authorization:`Bearer ${t.to... L4: `),{id:s,promise:r,cancel:i=>{let a=this.pendingRequests.get(s);a&&(this.pendingRequests.delete(s),a.reject(i))}}}sendNotification(e,n){if(!this.proc)throw new Error("ACP client no...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-BUKVIEU7.jsView on unpkg · L1

Findings

3 High2 Medium4 Low

HighChild Processdist/chunk-BUKVIEU7.js

HighSame File Env Network Executiondist/chunk-BUKVIEU7.js

HighCommand Output Exfiltrationdist/chunk-BUKVIEU7.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/chunk-BUKVIEU7.jsView file

Lines 1-21javascript

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-BUKVIEU7.jsView on unpkg · L1

12\u26A0\uFE0F Device identity changed and must be re-approved.

14Copy and paste the following prompt into the OpenClaw chat to re-approve this device:

16\`\`\`

17${u}

20\u8BF7\u5728 OpenClaw \u4E2D\u5B8C\u6210\u4EE5\u4E0B\u6B65\u9AA4\uFF1A

Long lines were clipped for display.