registry / Credential exfiltration / clavue-v1 / 1.22.6

clavue-v1@1.22.6

Clavue v1: lightweight four-slot (main/light/plan/review) multi-model coding CLI on the execution-first engine — overlapped cross-family review, official Clavue cloud preset (api.clavue.com) alongside any Messages-compatible provider, learned context ceil

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The transfer is user-invoked, but the destination can be changed to an unrestricted origin while the code supplies a saved service credential. This supports a conditional credential exposure warning, not a publish block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The user invokes the router pull or load command.

Impact

A saved membership credential may be disclosed to an operator-configured recipient.

Mechanism

The code resolves a token from CLAVUE_ROUTER_TOKEN or the saved official provider credential, then sends it as a Bearer header to the configured origin.

AI rationale

Evidence

dist/provider-router.jsdist/cli.js

Network endpoints1

router.clavue.com/v1/pack

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package reads a credential from the official cloud provider profile.
The router origin can be overridden through CLAVUE_ROUTER_ORIGIN, and the request can use the saved official credential.
The router pull request sends its token as a Bearer authorization header.
The transfer occurs when the user invokes the router pull or load command through the CLI.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 7 file(s), 4.48 MB of source, external domains: 1.1.1.1, 169.254.169.254, accounts.google.com, api-staging.anthropic.com, api.anthropic.com, api.clavue.com, api.kimi.com, api.minimaxi.com, beacon.claude-ai.staging.ant.dev, cdn.growthbook.io, claude-ai.staging.ant.dev, claude-staging.fedstart.com, claude.fedstart.com, cloud.google.com, cloudresourcemanager.googleapis.com, code.claude.com, docs.anthropic.com, docs.expo.dev, git-scm.com, github.com, hooks.example.com, json-schema.org, json.schemastore.org, mcp-proxy-staging.anthropic.com, metadata.google.internal, oauth2.googleapis.com, open.bigmodel.cn, openrouter.ai, platform.claude.com, platform.staging.ant.dev, router.clavue.com, www.clavue.com, www.googleapis.com, www.gstatic.com, your-gateway.example.com

Source & flagged code

12 flagged

dist/mao-command.jsView file

4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos... L6: `,"utf8"),process4.platform!=="win32")try{fs.chmodSync(filePath,384)}catch{}}__name(defaultWriteJsonFile,"defaultWriteJsonFile");function defaultSafeReadFile(filePath){try{return f...

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

15${formatCommandFailure(result)} L16: `}:{type:"text",value:renderJobResult2(completedJob)}}__name(runForegroundJob2,"runForegroundJob");function getStatusJobs2(cwd,limit=8,all=!1){let jobs=listEnrichedJobs(cwd);return... L17: `,"utf8")}finally{try{await release()}catch{}}return filePath}__name(writeMaoCoordinationLedger,"writeMaoCoordinationLedger");async function acquireLedgerLock(filePath){try{await f...

High

Shell

Package source references shell execution.

dist/mao-command.jsView on unpkg · L15

node_modules/ajv/dist/compile/jtd/serialize.jsView file

49sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`; L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode); L51: const serialize = makeSerialize(this.scope.get());

High

Eval

Package source references dynamic code evaluation.

node_modules/ajv/dist/compile/jtd/serialize.jsView on unpkg · L49

dist/provider-router.jsView file

3// clavue v1.22.6 provider-router (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: `?(templateIndex-=1,rawIndex+=1):nextRawCharacter==="u"&&rawTemplate[rawIndex+2]==="{"?rawIndex=rawTemplate.indexOf("}",rawIndex+3):rawIndex+=ESCAPE_LENGTH[nextRawCharacter]??1}}le... L6: `]),ESCAPE_LENGTH={x:3,u:5},concatTokens=__name((tokens,nextTokens,isSeparated)=>isSeparated||tokens.length===0||nextTokens.length===0?[...tokens,...nextTokens]:[...tokens.slice(0,... L7: It must be "${optionName}.stdout", "${optionName}.stderr", "${optionName}.all", "${optionName}.ipc", or "${optionName}.fd3", "${optionName}.fd4" (and so on).`);if(fdNumber>=o

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/provider-router.jsView on unpkg · L3

32${originalMessage}`}return cwdStat.isDirectory()?originalMessage:`The "cwd" option is not a directory: ${cwd2}. L33: ${originalMessage}`},"fixCwdError")}});import path5 from"node:path";import process6 from"node:process";var import_cross_spawn,normalizeOptions,addDefaultOptions,getEnv,init_options... L34: `,LF_BINARY=LF.codePointAt(0),CR="\r",CR_BINARY=CR.codePointAt(0)}});function isStream(stream4,{checkOpen=!0}={}){return stream4!==null&&typeof stream4=="object"&&(stream4.writable... ... L45: Instead, \`yield\` should either be called with a value, or not be called at all. For example: L46: if (condition) { yield value; }`)},"validateEmptyReturn")}});import{Buffer as Buffer3}from"node:buffer";import{StringDecoder as StringDecoder2}from"node:string_decoder";var getEnco... L47: `):[]}}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/provider-router.jsView on unpkg · L32

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4442900 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1668 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 14962918 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 14962918 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged · loading source

dist/mao-command.jsView file

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

High

Shell

Package source references shell execution.

dist/mao-command.jsView on unpkg · L15

node_modules/ajv/dist/compile/jtd/serialize.jsView file

Findings

1 Critical7 High7 Medium5 Low

CriticalCredential Exfiltrationdist/provider-router.js

HighChild Processdist/mao-command.js

HighShelldist/mao-command.js

HighEvalnode_modules/ajv/dist/compile/jtd/serialize.js

HighSame File Env Network Executiondist/provider-router.js

HighCommand Output Exfiltrationdist/provider-router.js

HighCloud Metadata Accessdist/provider-router.js

HighSemantic Analysis Limitednode_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/http-proxy.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/vendor/ripgrep/x64-darwin/rg

MediumShips Build Helper

Affected versions and remediation

This report applies to clavue-v1@1.22.6.

See all versions of clavue-v1 for other recorded verdicts.

Review the evidence and your use of clavue-v1@1.22.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 23:55:19.388Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code