registry / claw-coder / 0.3.18

claw-coder@0.3.18

Claw coder is a local first AI agent that turns local coding small LLMs into powerful AI agents that actually work

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 48.3 KB of source, external domains: api.github.com, github.com, nqbrdafvdfntxvhbyama.supabase.co, ollama.com

Source & flagged code

5 flagged

bin/auth.jsView file

Lines 1-22javascript

1"use strict";

3const fs = require("node:fs");

4const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/auth.jsView on unpkg · L2

5const path = require("node:path");

7const SESSION_DIR = path.join(os.homedir(), ".claw-coder");

8const SESSION_FILE = path.join(SESSION_DIR, "session.json");

10const BAKED_CONFIG = {

11 supabaseUrl: "https://nqbrdafvdfntxvhbyama.supabase.co",

12 anonKey: "sb_publishable_dJ4iZhUk8OySw4avgJ6Q7g_rsr_eUgg",

13 githubClientId: "Ov23li6ZYK8WmGloMm90",

14};

16// ─────────────────────────────────────────────────────────────────────────────

18function loadEnvFile() {

19 const envFile = path.join(path.resolve(__dirname, ".."), ".env");

20 if (fs.existsSync(envFile)) {

21 for (const line of fs.readFileSync(envFile, "utf8").split("\n")) {

22 const trimmed = line.trim();

Lines 193-233javascript

193 ` and tick the "Enable Device Flow" checkbox.`

194 );

195 }

196 if (!device.verification_uri) {

197 throw new Error(

198 `GitHub returned unexpected response: ${JSON.stringify(device)}

bin/claw-coder.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { spawnSync, spawn } = require("node:child_process");

5const fs = require(

agent_sever.pyView file

•path = agent_sever.py kind = build_helper sizeBytes = 29346 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agent_sever.pyView on unpkg

Source & flagged code

5 flagged · loading source

bin/auth.jsView file

213try { L214: require("child_process").execSync(`${cmd} "${device.verification_uri}"`, { stdio: "ignore" }); L215: } catch {}

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code