@vaibot/circuit-breaker-openclaw-plugin@1.3.1
OpenClaw plugin that enforces VAIBot governance decisions with a multi-source decision chain and circuit-breaker fallback.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package performs unconsented postinstall mutation of a broad AI-agent control surface by altering unrelated plugin entries. The backup and conditional skip do not limit the mutation when the hook runs.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation runs the postinstall hook, unless OPENCLAW_PLUGIN_INSTALL is set.
Impact
Unrelated plugins' configuration can be altered during installation, and this plugin is enabled automatically.
Mechanism
The hook patches the OpenClaw config across all plugin entries and writes the result back.
Policy narrative
During npm installation, the postinstall hook edits the shared OpenClaw config: it removes path keys from all plugin entries, writes the updated config, and enables this plugin. The hook has no consent check for modifying unrelated entries; the OPENCLAW_PLUGIN_INSTALL check only skips work when that variable is set.
AI rationale
The package performs unconsented postinstall mutation of a broad AI-agent control surface by altering unrelated plugin entries. The backup and conditional skip do not limit the mutation when the hook runs.
Evidence
package.jsonscripts/postinstall.mjs~/.openclaw/openclaw.json~/.openclaw/extensions/circuit-breaker-openclaw-plugin
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall.mjs as an npm postinstall hook.
- The installer iterates over all OpenClaw plugin entries and deletes each entry's path key.
- The installer also enables its own plugin entry.
- For parseable config, it writes the patched config back to the shared OpenClaw config file.
- The direct postinstall invocation calls main unless OPENCLAW_PLUGIN_INSTALL is set.
Evidence against
- The installer backs up an existing config file before changing it.
- The installer skips its work when OPENCLAW_PLUGIN_INSTALL is set.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/verify-pack.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process'
L3:
High
Child Process
Package source references child process execution.
scripts/verify-pack.mjsView on unpkg · L1Findings
2 Critical6 High4 Medium4 Low
CriticalSame File Env Network Executionvendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1
CriticalAi Agent Control Hijackscripts/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/verify-pack.mjs
HighSemantic Analysis Limitedvendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityvendor/vaibot-guard/scripts/vaibot-guard-exec.mjs
HighKnown Malware Source Similarityvendor/vaibot-guard/scripts/lib/guard-launch.mjs
HighPrevious Version Dangerous Deltavendor/vaibot-guard/scripts/vaibot-guard.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
Affected versions and remediation
This report applies to @vaibot/circuit-breaker-openclaw-plugin@1.3.1.
See all versions of @vaibot/circuit-breaker-openclaw-plugin for other recorded verdicts.
- Avoid installing @vaibot/circuit-breaker-openclaw-plugin@1.3.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.