registry / AI-agent control-surface risk / claw-subagent-service

claw-subagent-service

虾说运维助手

This report shows the evidence for claw-subagent-service@1.4.0. 35 of 35 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The source establishes a concrete postinstall-to-service-to-OpenClaw-mutation chain. Under the firewall policy, this requires blocking even though the code frames the changes as plugin cleanup.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall on Windows with administrator privileges

Impact

Unconsented disruption and control-surface modification of an existing AI-agent installation; service also auto-installs and runs an agent runtime.

Mechanism

persistent service startup followed by foreign OpenClaw configuration mutation

Policy narrative

The automatic postinstall service starts the worker without an explicit user command. Worker startup calls ensurePluginsAllow(), which edits ~/.openclaw/openclaw.json, removes allow-list entries, and renames or deletes OpenClaw extension directories. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The source establishes a concrete postinstall-to-service-to-OpenClaw-mutation chain. Under the firewall policy, this requires blocking even though the code frames the changes as plugin cleanup.

Evidence

package.jsonscripts/post-install.jsservice/worker.jsservice/rongcloud/openclaw-config.jsservice/modules/device-registration.jsservice/modules/opencode-starter.jsservice/daemon.js~/.openclaw/openclaw.json~/.openclaw/extensions/openclaw-weixin~/.openclaw/extensions/openclaw-wechat

Network endpoints4

newsradar.dreamdt.cnnewsradar.dreamdt.cn/imapi.rong-api.comapi-b.rong-api.com

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
scripts/post-install.js registers and starts an auto-restarting Windows service when admin.
service/worker.js invokes ensurePluginsAllow() at service startup.
service/rongcloud/openclaw-config.js edits ~/.openclaw/openclaw.json and removes/disables OpenClaw plugins.
worker reads OpenClaw-linked config and obtains an operations token from newsradar.dreamdt.cn.
service/modules/opencode-starter.js installs and starts opencode-ai automatically.

Evidence against

The OpenClaw mutation targets named removed/broken plugins rather than adding a hidden plugin.
No direct secret upload or obfuscated payload was found in inspected source.
The local HTTP listener binds to 127.0.0.1 by default.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

9 flagged

package.jsonView file

Lines 1-30json

2 "name": "claw-subagent-service",

3 "version": "1.4.0",

4 "description": "虾说运维助手",

5 "main": "cli.js",

6 "bin": {

7 "claw-subagent-service": "cli.js"

8 },

9 "scripts": {

10 "postinstall": "node scripts/post-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

11 "preuninstall": "node scripts/pre-uninstall.js",

12 "install-service": "node scripts/install-silent.js",

13 "uninstall-service": "node scripts/uninstall.js",

14 "dev": "node cli.js --run",

15 "publish:patch": "npm version patch && npm publish",

16 "publish:minor": "npm version minor && npm publish",

17 "publish:major": "npm version major && npm publish",

18 "unpublish:last": "node scripts/unpublish.js",

19 "unpublish:version": "node scripts/unpublish.js",

20 "deprecate:last": "npm deprecate $(node -p \"require('./package.json').name\")@$(node -p \"require('./package.json').version\") \"This version is deprecated. Please upgrade.\"",

21 "deprecate:version": "npm deprecate",

22 "sync": "node scripts/sync-local.js"

23 },

24 "files": [

25 "cli.js",

26 "service/",

27 "scripts/",

28 "command/",

29 "version.json",

30 "README.md"

scripts/pre-uninstall.jsView file

Lines 1-27javascript

1/**

2 * npm preuninstall 钩子

3 * 在卸载旧版本前停止并删除 Windows 服务，释放文件锁

4 *

5 * 设计原则：完全同步执行，多层兜底，不依赖 node-windows 异步事件。

6 * npm 运行此脚本时会等待进程退出，因此所有操作必须阻塞完成。

7 */

8const { execSync } = require('child_process');

service/rongcloud/rongcloud-server-api.jsView file

Lines 1-23javascript

1/**

2 * 融云服务端 API 客户端

3 * 直接从 silent-service 调用融云 REST API，无需通过服务端代理

4 * 文档: https://docs.rongcloud.cn/platform-chat-api/message/send-private-stream

5 */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

service/rongcloud/rongcloud-server-api.jsView on unpkg · L3

7const axios = require

scripts/install-silent.jsView file

Lines 1-21javascript

1const path = require('path');

2const { exec } = require('child_process');

3const fs =

scripts/sync-local.jsView file

Lines 207-247javascript

207 fs.copyFileSync(src, dest);

208 }

209 console.log(` ✅ ${file}`);

210 } catch (e) {

211 console.error(` ❌ ${file}: ${e.

service/daemon/clawsubagentservice.exeView file

•path = [redacted].exe kind = native_binary sizeBytes = 59392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

service/daemon/clawsubagentservice.exeView on unpkg

scripts/force-cleanup.ps1View file

•path = scripts/force-cleanup.ps1 kind = build_helper sizeBytes = 2477 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/force-cleanup.ps1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/post-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/pre-uninstall.jsView file

7*/ L8: const { execSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

scripts/pre-uninstall.jsView on unpkg · L7

56L57: // 4. 兜底：通过 PowerShell 按命令行路径匹配，杀掉所有包含 claw-subagent 的 node 进程 L58: try {

High

Shell

Package source references shell execution.

scripts/pre-uninstall.jsView on unpkg · L56

Findings

4 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/pre-uninstall.js

HighShellscripts/pre-uninstall.js

HighRuntime Package Installscripts/sync-local.js

MediumDynamic Requirescripts/pre-uninstall.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/install-silent.js

MediumShips Native Binaryservice/daemon/clawsubagentservice.exe

MediumShips Build Helperscripts/force-cleanup.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Crypto

Affected versions and remediation

This report applies to claw-subagent-service@1.4.0.

The versions list below shows the verdict for each recorded version.

Avoid installing claw-subagent-service@1.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 17:21:45.234Z (UTC).

Source advisory published: 2026-05-14 19:25:16.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

35 known versions

1.4.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 23, 2026, 5:34 AM 0.0.179MaliciousMalwareBlockPublishedJun 4, 2026, 5:40 AM 0.0.177MaliciousMalwareBlockPublishedJun 3, 2026, 5:35 AM 0.0.170MaliciousMalwareBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Related packages

Other AI-agent control-surface risk packages

Source & flagged code