@yoooclaw/phone-notifications@1.13.1
后台同步手机通知数据到本地存储，供 Agent 查询消费
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete malware or unconsented npm lifecycle mutation was found. The unauthenticated remote update path is nevertheless a significant runtime supply-chain risk exposed to an agent/gateway surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
OpenClaw plugin startup registers the tool; a user, agent, or gateway caller invokes plugin.update/plugin-update, or a user runs ntf update.
Impact
A compromised configured update source can supply code that replaces and subsequently executes as the plugin.
Mechanism
remote unsigned updater and package replacement
AI rationale
No concrete malware or unconsented npm lifecycle mutation was found. The unauthenticated remote update path is nevertheless a significant runtime supply-chain risk exposed to an agent/gateway surface.
Evidence
package.jsonopenclaw.plugin.jsondist/index.cjsdist/bin/ntf.cjs
Network endpoints3
artifact.yoooclaw.com/pluginartifacts-test.yoooclaw.com/pluginregistry.npmjs.org/@yoooclaw/phone-notifications
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.cjs registers a startup plugin-update tool and gateway method.
- dist/index.cjs downloads an unsigned tgz from artifact.yoooclaw.com, replaces the installed package, and restarts the host.
- dist/bin/ntf.cjs downloads install-core.mjs and executes it for explicit `ntf update`.
Evidence against
- package.json has only prepublishOnly; no install-time hook.
- Automatic updates check availability; installation requires a tool/gateway or CLI update action.
- Credential use is service-aligned relay/API authentication; no unrelated env harvesting found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/bin/ntf.cjsView file
67class CommanderError extends Error {
L68: constructor(exitCode, code, message) {
L69: super(message);
...
L785: var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
L787: var path = require("node:path");
...
L831: this._outputConfiguration = {
L832: writeOut: (str) => process2.stdout.write(str),
L833: writeErr: (str) => process2.stderr.write(str),
...
L2190: }
L2191: function homeDir() {
L2192: return process.env.HOME || process.env.USERPROFILE || "/tmp";
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/bin/ntf.cjsView on unpkg · L67785var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
L787: var path = require("node:path");
High
784var require_command = __commonJS((exports2) => {
L785: var EventEmitter = require("node:events").EventEmitter;
L786: var childProcess = require("node:child_process");
Medium
Findings
3 Critical3 High5 Medium6 Low
CriticalCredential Exfiltrationdist/index.cjs
CriticalCommand Output Exfiltrationdist/bin/ntf.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighChild Processdist/bin/ntf.cjs
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighTrigger Reachable Persistencedist/index.cjs
MediumDynamic Requiredist/bin/ntf.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.cjs
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to @yoooclaw/phone-notifications@1.13.1.
See all versions of @yoooclaw/phone-notifications for other recorded verdicts.
- Review the evidence and your use of @yoooclaw/phone-notifications@1.13.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.