Loading npm security reports…

clawmoney@0.18.1: AI-agent policy block | LPM Firewall

registry / clawmoney / 0.18.1

clawmoney@0.18.1

ClawMoney CLI -- Earn rewards with your AI agent

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package mutates AI-agent control surfaces at install time by fetching a remote skill file and installing it into Claude, OpenClaw, and Codex skill/command directories. This gives the package publisher postinstall control over future agent behavior without the installed npm tarball containing the skill content.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install postinstall lifecycle

Impact

Unconsented modification of local AI-agent command/skill surfaces and execution of external installers during dependency installation.

Mechanism

remote AI-agent skill installation plus runtime package-manager install

Policy narrative

On npm install, package.json runs scripts/install-skill.cjs, which downloads remote Markdown from clawmoney.ai and writes it directly into Claude, OpenClaw, and Codex agent skill locations. Because the installed agent instructions are fetched live from the publisher rather than pinned in the package, the install hook can silently alter future AI-agent behavior outside normal npm package review. A second postinstall script also attempts to install yt-dlp through system package managers.

Rationale

Direct source inspection confirms unconsented lifecycle writes into AI-agent control-surface directories from remote content, which meets the firewall blocking criterion for AI-agent control hijack. Other credential and relay code appears mostly user-invoked, but the postinstall behavior alone is sufficient to classify this package as malicious.

Evidence

package.jsonscripts/install-skill.cjsscripts/install-ytdlp.cjsdist/relay/upstream/claude-bootstrap.jsscripts/probe-claude-api.mjs

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for policy block

package.json runs postinstall: node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs.
scripts/install-skill.cjs fetches https://clawmoney.ai/skill.md during npm install.
scripts/install-skill.cjs writes fetched remote content into ~/.claude/commands/clawmoney.md, ~/.openclaw/skills/clawmoney/SKILL.md, and ~/.codex/skills/clawmoney/SKILL.md.
scripts/install-ytdlp.cjs runs brew/pipx/pip3/apt-get/winget installers for yt-dlp during postinstall if missing.
dist/relay/upstream/claude-bootstrap.js can spawn claude with ANTHROPIC_BASE_URL pointed at localhost and capture account/device fingerprint.
scripts/probe-claude-api.mjs reads Claude Code OAuth credentials and posts bearer-authenticated requests to api.anthropic.com.

Evidence against

package.json main/bin entrypoint is a CLI, not automatic import-time execution beyond npm lifecycle.
Credential-reading probe scripts are not invoked by package.json lifecycle hooks.
Network use to api.bnbot.ai/clawmoney.ai is broadly aligned with the package's advertised agent marketplace/relay functionality.
No obfuscated JavaScript or eval/Function payload was found in inspected hot files.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 260 file(s), 1.11 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.bnbot.ai, api.github.com, api.iconify.design, api.kimi.com, api.minimax.io, api.minimaxi.com, api.z.ai, auth.kimi.com, auth.openai.com, chatgpt.com, chromewebstore.google.com, clawmoney.ai, cloudcode-pa.googleapis.com, coding.dashscope.aliyuncs.com, creator.douyin.com, creator.xiaohongshu.com, daily-cloudcode-pa.sandbox.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, keepachangelog.com, labs.google, m.tiktok.com, mainnet.base.org, myaccount.google.com, oauth2.googleapis.com, pay.clawmoney.ai, platform.claude.com, semver.org, twitter.com, witness.bnbot.ai, www.bilibili.com, www.googleapis.com, www.tiktok.com, www.w3.org, www.youtube.com, x.com

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/companion.jsView file

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/companion.jsView on unpkg · L9

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs'; ... L16: import { loadConfig } from '../utils/config.js'; L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: // Companion source shipped in the npm package: dist/ui/ -> ../../companion ... L21: const RUN_DIR = path.join(os.homedir(), '.clawmoney', 'companion'); L22: const COMPANION_FILES = ['main.js', 'package.json', 'tray-icon.png', 'icon.png', 'icon.icns', 'preload.js']; L23: function copyCompanionFiles() { ... L42: function electronBinaryPath() { L43: if (process.platform === 'darwin') { L44: const dist = path.join(RUN_DIR, 'node_modules', 'electron', 'dist');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/ui/companion.jsView on unpkg · L9

dist/commands/tweet.jsView file

15stdio: 'inherit', L16: shell: true, L17: });

High

Shell

Package source references shell execution.

dist/commands/tweet.jsView on unpkg · L15

dist/relay/upstream/claude-bootstrap.jsView file

284const childEnv = { L285: ...process.env, L286: ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`, L287: NO_PROXY: "127.0.0.1,localhost", ... L295: // users into a lower safety setting without consent. L296: claudeChild = spawn("claude", ["-p", "hi"], { L297: env: childEnv,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/relay/upstream/claude-bootstrap.jsView on unpkg · L284

scripts/probe-claude-api.mjsView file

11L12: import { execFileSync } from "node:child_process"; L13: import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs"; ... L16: import { randomUUID } from "node:crypto"; L17: import { ProxyAgent, setGlobalDispatcher } from "undici"; L18: ... L22: const proxyUrl = L23: process.env.HTTPS_PROXY || L24: process.env.https_proxy || ... L46: L47: const CLAWMONEY_DIR = join(homedir(), ".clawmoney"); L48: const FINGERPRINT_FILE = join(CLAWMONEY_DIR, "claude-fingerprint.json");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

scripts/probe-claude-api.mjsView on unpkg · L11

dist/utils/awal.jsView file

14return new Promise((resolve, reject) => { L15: const child = spawn('npx', ['awal', ...finalArgs], { L16: stdio: ['inherit', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/awal.jsView on unpkg · L14

scripts/install-market-launchd.shView file

•path = scripts/install-market-launchd.sh kind = build_helper sizeBytes = 6489 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-market-launchd.shView on unpkg

companion/icon.icnsView file

•path = companion/icon.icns kind = high_entropy_blob sizeBytes = 714079 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

companion/icon.icnsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-38json

1{

2 "name": "clawmoney",

3 "version": "0.18.1",

4 "description": "ClawMoney CLI -- Earn rewards with your AI agent",

5 "type": "module",

6 "bin": {

7 "clawmoney": "dist/index.js"

8 },

9 "main": "dist/index.js",

10 "files": [

11 "dist",

12 "scripts",

13 "companion"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "dev": "tsc --watch",

18 "postinstall": "node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepublishOnly": "npm run build"

20 },

21 "dependencies": {

22 "@bnbot/cli": "^0.3.0",

23 "@clack/prompts": "^0.7.0",

24 "chalk": "^5.3.0",

25 "commander": "^12.0.0",

26 "ora": "^8.0.0",

27 "viem": "^2.48.1",

28 "ws": "^8.20.0",

29 "yaml": "^2.4.0"

30 },

31 "devDependencies": {

32 "@types/node": "^20.0.0",

33 "@types/ws": "^8.18.1",

34 "typescript": "^5.4.0"

35 },

36 "engines": {

37 "node": ">=18"

38 },

dist/ui/companion.jsView file

Lines 1-29javascript

1// Companion launcher: ensure the Electron companion is installed + running,

2// then talk to it. This is the "reverse-launch" awal does — the CLI brings up

3// the GUI on demand, zero app install for the user.

4//

5// Why a per-user run dir (~/.clawmoney/companion) instead of running straight

6// from the installed package: the global npm package dir is often not writable,

7// and we need to `npm i electron` somewhere. So we copy the tiny companion

8// files into the user's home and install Electron there (awal uses env-paths

9// for the same reason).

10import

dist/commands/tweet.jsView file

Lines 1-30javascript

1import chalk from 'chalk';

2import { spawn } from 'node:child_process';

3/**

4 * Post a tweet by delegating to @bnbot/cli.

5 */

6export async function

dist/relay/upstream/claude-bootstrap.jsView file

Lines 264-304javascript

264 cleanup();

265 reject(new Error(`bootstrap proxy server error: ${err.message}`));

266 });

267 server.listen(0, "127.0.0.1"

scripts/probe-claude-api.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Validate that a locally-logged-in Claude Code OAuth token can be used to

3// call api.anthropic.com directly with the exact headers + body shape Claude

4// Code sends (captured from claude-cli/2.1.100 via ANTHROPIC_LOG=debug).

5//

6// Usage:

7// node scripts/probe-claude-api.mjs # send test request

8// node scripts/probe-claude-api.mjs --refresh # force refresh first

9// node scripts/probe-claude-api.mjs --prompt "hello"

10// node scripts/probe-claude-api.mjs --model claude-sonnet-4-5

dist/utils/awal.jsView file

Lines 1-34javascript

1import { spawn } from 'node:child_process';

2// Windows resolves .cmd / .bat launchers only through the shell;

3// POSIX (macOS/Linux) `spawn` walks PATH on its own and prints a

4// DEP0190 deprecation warning when shell:true is combined with

5// argument arrays. Keep shell:true only where we actually need it.

6const USE_SHELL = process.platform === 'win32'

scripts/install-market-launchd.shView file

•path = scripts/install-market-launchd.sh kind = build_helper sizeBytes = 6489 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-market-launchd.shView on unpkg

companion/icon.icnsView file

•path = companion/icon.icns kind = high_entropy_blob sizeBytes = 714079 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

companion/icon.icnsView on unpkg