registry / claw-coder / 0.1.3

claw-coder@0.1.3

Claw coder is a local first AI agent that turns local coding small LLMs into powerful AI agents that actually work

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 29.6 KB of source, external domains: api.github.com, github.com, yourref.supabase.co

Source & flagged code

4 flagged

bin/auth.jsView file

Lines 1-22javascript

1"use strict";

3const fs = require("node:fs");

4const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/auth.jsView on unpkg · L2

5const path = require("node:path");

7const SESSION_DIR = path.join(os.homedir(), ".claw-coder");

8const SESSION_FILE = path.join(SESSION_DIR, "session.json");

10// ── Baked-in config — users need zero setup ───────────────────────────────────

11const BAKED_CONFIG = {

12 supabaseUrl: "https://yourref.supabase.co",

13 anonKey: "your-anon-key",

14 githubClientId: "your-github-client-id",

15};

16// ─────────────────────────────────────────────────────────────────────────────

18function loadEnvFile() {

19 const envFile = path.join(path.resolve(__dirname, ".."), ".env");

20 if (fs.existsSync(envFile)) {

21 for (const line of fs.readFileSync(envFile, "utf8").split("\n")) {

22 const trimmed = line.trim();

Lines 195-235javascript

195 );

196 }

197 if (!device.verification_uri) {

198 throw new Error(

199 `GitHub returned unexpected response: ${JSON.stringify(device)}\n` +

200 `Check your GITHUB_CLIENT_ID in .env is correct.`

201 );

202 }

203

204 // Step 2 — show user the code

205 console.log("\n┌─────────────────────────────────────────┐");

206 console.log("│ Claw-Coder Login │");

207 console.log("├─────────────────────────────────────────┤");

208 console.log(`│ Open: ${device.verification_uri.padEnd(32)}│`);

209 console.log(`│ Code: ${device.user_code.padEnd(32)}│`);

210 console.log("└─────────────────────────────────────────┘\n");

211

212 const cmd = process.platform === "darwin" ? "open"

213 : process.platform === "win32" ? "start"

214 : "xdg-open";

215 try {

216 require("child_process").execSync(`${cmd} "${device.verification_uri}"`, { stdio: "ignore" });

217 } catch {}

High

Child Process

Package source references child process execution.

bin/auth.jsView on unpkg · L215

218

219 // Step 3 — poll GitHub until user approves

220 console.log("Waiting for you to approve in the browser...\n");

221 const pollInterval = (device.interval || 5) * 1000;

222 const expires = Date.now() + device.expires_in * 1000;

223

224 while (Date.now() < expires) {

225 await new Promise(r => setTimeout(r, pollInterval));

226

227 const tokenRes = await fetch("https://github.com/login/oauth/access_token", {

228 method: "POST",

229 headers: { "Content-Type": "application/json", "Accept": "application/json" },

230 body: JSON.stringify({

231 client_id: githubClientId,

232 device_code: device.device_code,

233 grant_type: "urn:ietf:params:oauth:grant-type:device_code",

234 }),

235 });

bin/claw-coder.jsView file

Lines 498-538javascript

498 }

499 apiFetch("/plan", session)

500 .then((data) => {

501 console.log(`\n Plan: ${String(data.plan || "free").toUpperCase()}`);

502 console.log(` Paid credits: ${data.credits || 0}`);

503 console.log(" Limited tools use free monthly allowance first, then paid credits.\n");

504 })

505 .catch((err) => {

506 console.error(`Could not fetch credits: ${err.message}`);

507 console.error("If this is Render free hosting, wait a few seconds and retry.");

508 process.exitCode = 1;

509 });

510 return;

511 }

512

513 if (command === "buy") {

514 let session;

515 try {

516 session = requireSession();

517 } catch (err) {

518 console.error(err.message);

519 process.exitCode = 1;

520 return;

521 }

522 console.log("Creating checkout for the $30/month Claw Coder plan...");

523 apiFetch("/checkout", session, { method: "POST", body: JSON.stringify({}) })

524 .then((data) => {

525 if (!data.checkout_url) {

526 throw new Error("The billing server did not return a checkout URL.");

527 }

528 console.log(`\n Monthly credits: ${data.credits}`);

529 console.log(` Checkout: ${data.checkout_url}\n`);

530 const opener = process.platform === "darwin" ? "open"

531 : process.platform === "win32" ? "start"

532 : "xdg-open";

533 try {

534 spawnSync(opener, [data.checkout_url], {

535 stdio: "ignore",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/claw-coder.jsView on unpkg · L518

536 shell: process.platform === "win32",

537 });

538 } catch {}

agent_sever.pyView file

•path = agent_sever.py kind = build_helper sizeBytes = 24186 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agent_sever.pyView on unpkg

Source & flagged code

4 flagged · loading source

bin/auth.jsView file

215try { L216: require("child_process").execSync(`${cmd} "${device.verification_uri}"`, { stdio: "ignore" }); L217: } catch {}

High

Child Process

Package source references child process execution.

bin/auth.jsView on unpkg · L215

2L3: const fs = require("node:fs"); L4: const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/auth.jsView on unpkg · L2

bin/claw-coder.jsView file

518console.error(err.message); L519: process.exitCode = 1; L520: return; ... L522: console.log("Creating checkout for the $30/month Claw Coder plan..."); L523: apiFetch("/checkout", session, { method: "POST", body: JSON.stringify({}) }) L524: .then((data) => { ... L533: try { L534: spawnSync(opener, [data.checkout_url], { L535: stdio: "ignore",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/claw-coder.jsView on unpkg · L518

agent_sever.pyView file

•path = agent_sever.py kind = build_helper sizeBytes = 24186 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agent_sever.pyView on unpkg

Findings

2 High5 Medium4 Low

HighChild Processbin/auth.js

HighCommand Output Exfiltrationbin/claw-coder.js

MediumDynamic Requirebin/auth.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperagent_sever.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/auth.jsView file

Lines 1-22javascript

1"use strict";

3const fs = require("node:fs");

4const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/auth.jsView on unpkg · L2

5const path = require("node:path");

7const SESSION_DIR = path.join(os.homedir(), ".claw-coder");

8const SESSION_FILE = path.join(SESSION_DIR, "session.json");

10// ── Baked-in config — users need zero setup ───────────────────────────────────

11const BAKED_CONFIG = {

12 supabaseUrl: "https://yourref.supabase.co",

13 anonKey: "your-anon-key",

14 githubClientId: "your-github-client-id",

15};

18function loadEnvFile() {

19 const envFile = path.join(path.resolve(__dirname, ".."), ".env");

20 if (fs.existsSync(envFile)) {

21 for (const line of fs.readFileSync(envFile, "utf8").split("\n")) {

22 const trimmed = line.trim();

Lines 195-235javascript

195 );

196 }

197 if (!device.verification_uri) {

198 throw new Error(

199 `GitHub returned unexpected response: ${JSON.stringify(device)}\n` +

200 `Check your GITHUB_CLIENT_ID in .env is correct.`

201 );

202 }

203

204 // Step 2 — show user the code

205 console.log("\n┌─────────────────────────────────────────┐");

206 console.log("│ Claw-Coder Login │");

207 console.log("├─────────────────────────────────────────┤");

208 console.log(`│ Open: ${device.verification_uri.padEnd(32)}│`);

209 console.log(`│ Code: ${device.user_code.padEnd(32)}│`);

210 console.log("└─────────────────────────────────────────┘\n");

211

212 const cmd = process.platform === "darwin" ? "open"

213 : process.platform === "win32" ? "start"

214 : "xdg-open";

215 try {

216 require("child_process").execSync(`${cmd} "${device.verification_uri}"`, { stdio: "ignore" });

217 } catch {}

High

Child Process

Package source references child process execution.

bin/auth.jsView on unpkg · L215

218

219 // Step 3 — poll GitHub until user approves

220 console.log("Waiting for you to approve in the browser...\n");

221 const pollInterval = (device.interval || 5) * 1000;

222 const expires = Date.now() + device.expires_in * 1000;

223

224 while (Date.now() < expires) {

225 await new Promise(r => setTimeout(r, pollInterval));

226

227 const tokenRes = await fetch("https://github.com/login/oauth/access_token", {

228 method: "POST",

229 headers: { "Content-Type": "application/json", "Accept": "application/json" },

230 body: JSON.stringify({

231 client_id: githubClientId,

232 device_code: device.device_code,

233 grant_type: "urn:ietf:params:oauth:grant-type:device_code",

234 }),

235 });

bin/claw-coder.jsView file

Lines 498-538javascript

498 }

499 apiFetch("/plan", session)

500 .then((data) => {

501 console.log(`\n Plan: ${String(data.plan || "free").toUpperCase()}`);

502 console.log(` Paid credits: ${data.credits || 0}`);

503 console.log(" Limited tools use free monthly allowance first, then paid credits.\n");

504 })

505 .catch((err) => {

506 console.error(`Could not fetch credits: ${err.message}`);

507 console.error("If this is Render free hosting, wait a few seconds and retry.");

508 process.exitCode = 1;

509 });

510 return;

511 }

512

513 if (command === "buy") {

514 let session;

515 try {

516 session = requireSession();

517 } catch (err) {

518 console.error(err.message);

519 process.exitCode = 1;

520 return;

521 }

522 console.log("Creating checkout for the $30/month Claw Coder plan...");

523 apiFetch("/checkout", session, { method: "POST", body: JSON.stringify({}) })

524 .then((data) => {

525 if (!data.checkout_url) {

526 throw new Error("The billing server did not return a checkout URL.");

527 }

528 console.log(`\n Monthly credits: ${data.credits}`);

529 console.log(` Checkout: ${data.checkout_url}\n`);

530 const opener = process.platform === "darwin" ? "open"

531 : process.platform === "win32" ? "start"

532 : "xdg-open";

533 try {

534 spawnSync(opener, [data.checkout_url], {

535 stdio: "ignore",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/claw-coder.jsView on unpkg · L518

536 shell: process.platform === "win32",

537 });

538 } catch {}

agent_sever.pyView file

•path = agent_sever.py kind = build_helper sizeBytes = 24186 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agent_sever.pyView on unpkg