claw-subagent-service@1.4.0: AI-agent policy block | LPM Firewall

Loading npm security reports…

claw-subagent-service@1.4.0: AI-agent policy block | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/post-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/pre-uninstall.jsView file

7*/ L8: const { execSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

scripts/pre-uninstall.jsView on unpkg · L7

56L57: // 4. 兜底：通过 PowerShell 按命令行路径匹配，杀掉所有包含 claw-subagent 的 node 进程 L58: try {

High

Shell

Package source references shell execution.

scripts/pre-uninstall.jsView on unpkg · L56

7*/ L8: const { execSync } = require('child_process'); L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/pre-uninstall.jsView on unpkg · L7

service/rongcloud/rongcloud-server-api.jsView file

3* 直接从 silent-service 调用融云 REST API，无需通过服务端代理 L4: * 文档: https://docs.rongcloud.cn/platform-chat-api/message/send-private-stream L5: */ ... L87: try { L88: const response = await axios.post(url, data, { L89: headers,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

service/rongcloud/rongcloud-server-api.jsView on unpkg · L3

scripts/install-silent.jsView file

1const path = require('path'); L2: const { exec } = require('child_process'); L3: const fs = require('fs'); ... L5: L6: const ROOT = process.argv[2] || process.env.SILENT_SERVICE_DIR || path.join(__dirname, '..'); L7: const DAEMON_PATH = path.join(ROOT, 'service', 'daemon.js'); ... L20: L21: const platform = process.platform; L22: ... L125: fs.writeFileSync(serviceFile, serviceContent); L126: exec('systemctl daemon-reload && systemctl enable ' + SERVICE_NAME, (err) => { L127: if (err) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install-silent.jsView on unpkg · L1

scripts/sync-local.jsView file

227try { L228: execSync('npm install --ignore-scripts --prefer-offline --no-audit --no-fund --progress=false', { L229: cwd: targetDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/sync-local.jsView on unpkg · L227

service/daemon/clawsubagentservice.exeView file

•path = [redacted].exe kind = native_binary sizeBytes = 59392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

service/daemon/clawsubagentservice.exeView on unpkg

scripts/force-cleanup.ps1View file

•path = scripts/force-cleanup.ps1 kind = build_helper sizeBytes = 2477 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/force-cleanup.ps1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "claw-subagent-service",

3 "version": "1.4.0",

4 "description": "虾说运维助手",

5 "main": "cli.js",

6 "bin": {

7 "claw-subagent-service": "cli.js"

8 },

9 "scripts": {

10 "postinstall": "node scripts/post-install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

11 "preuninstall": "node scripts/pre-uninstall.js",

12 "install-service": "node scripts/install-silent.js",

13 "uninstall-service": "node scripts/uninstall.js",

14 "dev": "node cli.js --run",

15 "publish:patch": "npm version patch && npm publish",

16 "publish:minor": "npm version minor && npm publish",

17 "publish:major": "npm version major && npm publish",

18 "unpublish:last": "node scripts/unpublish.js",

19 "unpublish:version": "node scripts/unpublish.js",

20 "deprecate:last": "npm deprecate $(node -p \"require('./package.json').name\")@$(node -p \"require('./package.json').version\") \"This version is deprecated. Please upgrade.\"",

21 "deprecate:version": "npm deprecate",

22 "sync": "node scripts/sync-local.js"

23 },

24 "files": [

25 "cli.js",

26 "service/",

27 "scripts/",

28 "command/",

29 "version.json",

30 "README.md"

scripts/pre-uninstall.jsView file

Lines 1-27javascript

1/**

2 * npm preuninstall 钩子

3 * 在卸载旧版本前停止并删除 Windows 服务，释放文件锁

4 *

5 * 设计原则：完全同步执行，多层兜底，不依赖 node-windows 异步事件。

6 * npm 运行此脚本时会等待进程退出，因此所有操作必须阻塞完成。

7 */

8const { execSync } = require('child_process');

service/rongcloud/rongcloud-server-api.jsView file

Lines 1-23javascript

1/**

2 * 融云服务端 API 客户端

3 * 直接从 silent-service 调用融云 REST API，无需通过服务端代理

4 * 文档: https://docs.rongcloud.cn/platform-chat-api/message/send-private-stream

5 */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

service/rongcloud/rongcloud-server-api.jsView on unpkg · L3

6

7const axios = require

scripts/install-silent.jsView file

Lines 1-21javascript

1const path = require('path');

2const { exec } = require('child_process');

3const fs =

scripts/sync-local.jsView file

Lines 207-247javascript

207 fs.copyFileSync(src, dest);

208 }

209 console.log(` ✅ ${file}`);

210 } catch (e) {

211 console.error(` ❌ ${file}: ${e.

service/daemon/clawsubagentservice.exeView file

•path = [redacted].exe kind = native_binary sizeBytes = 59392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

service/daemon/clawsubagentservice.exeView on unpkg

scripts/force-cleanup.ps1View file

•path = scripts/force-cleanup.ps1 kind = build_helper sizeBytes = 2477 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/force-cleanup.ps1View on unpkg