registry / claw_messenger / 1.2.0-beta.38

claw_messenger@1.2.0-beta.38

⚠ Under review

OpenClaw 插件 - 虾说应用桥接

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 349 KB of source, external domains: 127.0.0.1, api.qrserver.com, newsradar.dreamdt.cn, registry.npmmirror.com

Source & flagged code

5 flagged

package.jsonView file

Lines 35-75json

35 },

36 "compat": {

37 "pluginApi": ">=2.0.0"

38 },

39 "install": {

40 "npmSpec": "claw_messenger",

41 "defaultChoice": "npx",

42 "minHostVersion": ">=2026.3.24"

43 }

44 },

45 "scripts": {

46 "build": "node ./node_modules/typescript/bin/tsc && copy /Y package.json dist\\ && copy /Y openclaw.plugin.json dist\\ && copy /Y bin\\postinstall.js dist\\postinstall.js && xcopy /E /I /Y src\\prompts dist\\src\\prompts && copy /Y src\\rongcloud-client.js dist\\src\\rongcloud-client.js && copy /Y src\\env-polyfill.js dist\\src\\env-polyfill.js",

47 "setup": "npm run build && node bin/install.js",

48 "install-local": "node bin/install.js",

49 "start": "node bin/dm-bridge.cjs",

50 "bridge": "ts-node bridge-runner.ts",

51 "test": "vitest run",

52 "test:watch": "vitest",

53 "test:coverage": "vitest run --coverage",

54 "prepublishOnly": "npm run build",

55 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "publish:patch": "npm version patch && npm publish",

57 "publish:minor": "npm version minor && npm publish",

58 "publish:major": "npm version major && npm publish",

59 "unpublish:last": "node scripts/unpublish.js",

60 "unpublish:version": "node scripts/unpublish.js",

61 "deprecate:last": "npm deprecate $(node -p \"require('./package.json').name\")@$(node -p \"require('./package.json').version\") \"This version is deprecated. Please upgrade.\"",

62 "deprecate:version": "npm deprecate"

63 },

64 "keywords": [

65 "openclaw",

66 "claw-messenger",

67 "im",

68 "chat",

69 "bridge",

70 "ai"

71 ],

72 "author": "",

73 "license": "MIT",

74 "repository": {

75 "type": "git",

bin/dm-bridge.cjsView file

Lines 1-12javascript

1#!/usr/bin/env node

3/**

4 * DM Bridge CLI 入口

5 */

7const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/dm-bridge.cjsView on unpkg · L6

dist/src/rongcloud-server-api.jsView file

Lines 1-21javascript

1import axios from 'axios';

2import crypto from 'crypto';

3import { RONGCLOUD_API_HOSTS, RONGCLOUD_STREAM_PRIVATE_PATH, RONGCLOUD_STREAM_GROUP_PATH, RONGCLOUD_TYPING_GROUP_PATH, RONGCLOUD_TYPING_PRIVATE_PATH, RONGCLOUD_MESSAGE_PRIVATE_PATH, RONGCLOUD_MESSAGE_GROUP_PATH, } from '../config.js';

4export class

bin/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claw_messenger@1.2.0-beta.32 matchedIdentity = npm:Y2xhd19tZXNzZW5nZXI:1.2.0-beta.32 similarity = 0.852 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/install.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code