registry / claw_messenger / 1.2.0-beta.35

claw_messenger@1.2.0-beta.35

⚠ Under review

OpenClaw 插件 - 虾说应用桥接

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 271 KB of source, external domains: 127.0.0.1, api.qrserver.com, newsradar.dreamdt.cn, registry.npmmirror.com

Source & flagged code

5 flagged

package.jsonView file

Lines 34-74json

34 },

35 "compat": {

36 "pluginApi": ">=2.0.0"

37 },

38 "install": {

39 "npmSpec": "claw_messenger",

40 "defaultChoice": "npx",

41 "minHostVersion": ">=2026.3.24"

42 }

43 },

44 "scripts": {

45 "build": "node ./node_modules/typescript/bin/tsc && copy /Y package.json dist\\ && copy /Y openclaw.plugin.json dist\\ && copy /Y bin\\postinstall.js dist\\postinstall.js && xcopy /E /I /Y src\\prompts dist\\src\\prompts && copy /Y src\\rongcloud-client.js dist\\src\\rongcloud-client.js && copy /Y src\\env-polyfill.js dist\\src\\env-polyfill.js",

46 "setup": "npm run build && node bin/install.js",

47 "install-local": "node bin/install.js",

48 "start": "node bin/dm-bridge.cjs",

49 "bridge": "ts-node bridge-runner.ts",

50 "test": "vitest run",

51 "test:watch": "vitest",

52 "test:coverage": "vitest run --coverage",

53 "prepublishOnly": "npm run build",

54 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "publish:patch": "npm version patch && npm publish",

56 "publish:minor": "npm version minor && npm publish",

57 "publish:major": "npm version major && npm publish",

58 "unpublish:last": "node scripts/unpublish.js",

59 "unpublish:version": "node scripts/unpublish.js",

60 "deprecate:last": "npm deprecate $(node -p \"require('./package.json').name\")@$(node -p \"require('./package.json').version\") \"This version is deprecated. Please upgrade.\"",

61 "deprecate:version": "npm deprecate"

62 },

63 "keywords": [

64 "openclaw",

65 "claw-messenger",

66 "im",

67 "chat",

68 "bridge",

69 "ai"

70 ],

71 "author": "",

72 "license": "MIT",

73 "repository": {

74 "type": "git",

bin/dm-bridge.cjsView file

Lines 1-12javascript

1#!/usr/bin/env node

3/**

4 * DM Bridge CLI 入口

5 */

7const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/dm-bridge.cjsView on unpkg · L6

dist/src/rongcloud-server-api.jsView file

Lines 1-21javascript

1import axios from 'axios';

2import crypto from 'crypto';

3import { RONGCLOUD_API_HOSTS, RONGCLOUD_STREAM_PRIVATE_PATH, RONGCLOUD_STREAM_GROUP_PATH, RONGCLOUD_TYPING_GROUP_PATH, RONGCLOUD_TYPING_PRIVATE_PATH, RONGCLOUD_MESSAGE_PRIVATE_PATH, RONGCLOUD_MESSAGE_GROUP_PATH, } from '../config.js';

4export class

dist/src/openclaw-client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claw_messenger@1.2.0-beta.32 matchedIdentity = npm:Y2xhd19tZXNzZW5nZXI:1.2.0-beta.32 similarity = 0.926 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/src/openclaw-client.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code