Loading npm security reports…

clawmoney@0.18.2: AI-agent policy block | LPM Firewall

registry / clawmoney / 0.18.2

clawmoney@0.18.2

Renamed to 'spareai' — install with: npm i -g spareai

ClawMoney CLI -- Earn rewards with your AI agent

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code fetches remote AI-agent instructions and writes them into local agent control directories. The package also runs system package-manager installs for yt-dlp during postinstall.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of clawmoney@0.18.2

Impact

Unconsented mutation of Claude/Codex/OpenClaw control surfaces can steer future agent behavior; install-time system package-manager execution expands supply-chain impact.

Mechanism

postinstall AI-agent skill/command installation plus package-manager execution

Policy narrative

On npm install, the package runs a postinstall hook that retrieves https://clawmoney.ai/skill.md and writes it into Claude, Codex, and OpenClaw agent instruction locations under the user's home directory. This creates or changes future AI-agent behavior without a user-invoked setup command. A second postinstall script executes host package managers to install yt-dlp. Runtime relay code also proxies spawned AI CLI traffic, but the blocking issue is the install-time control-surface mutation.

Rationale

Source inspection confirms unconsented lifecycle writes into AI-agent control directories, which is a concrete malicious install-time behavior under the firewall policy. Other credential and network primitives are mostly user-invoked relay functionality, but they do not neutralize the postinstall agent hijack surface. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonscripts/install-skill.cjsscripts/install-ytdlp.cjsdist/relay/upstream/claude-bootstrap.jsscripts/probe-claude-api.mjs

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for policy block

package.json postinstall runs scripts/install-skill.cjs and scripts/install-ytdlp.cjs
scripts/install-skill.cjs fetches https://clawmoney.ai/skill.md during install
scripts/install-skill.cjs writes fetched content into ~/.claude/commands, ~/.openclaw/skills, and ~/.codex/skills
scripts/install-ytdlp.cjs runs brew/pipx/pip3/apt-get/winget install commands during postinstall
dist/relay/upstream/claude-bootstrap.js spawns claude with ANTHROPIC_BASE_URL pointed at a local proxy and forwards requests to api.anthropic.com
scripts/probe-claude-api.mjs reads Claude credentials and can call api.anthropic.com, though it is not a lifecycle entrypoint

Evidence against

dist/index.js CLI commands and Base RPC calls are user-invoked, package-aligned wallet/relay behavior
scripts/probe-claude-api.mjs is not referenced by package.json lifecycle scripts, bin, or main
No hidden import-time execution observed in dist/index.js beyond Commander command registration
No broad filesystem harvesting loop or credential exfiltration to an unrelated attacker endpoint confirmed

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 260 file(s), 1.11 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.bnbot.ai, api.github.com, api.iconify.design, api.kimi.com, api.minimax.io, api.minimaxi.com, api.z.ai, auth.kimi.com, auth.openai.com, chatgpt.com, chromewebstore.google.com, clawmoney.ai, cloudcode-pa.googleapis.com, coding.dashscope.aliyuncs.com, creator.douyin.com, creator.xiaohongshu.com, daily-cloudcode-pa.sandbox.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, keepachangelog.com, labs.google, m.tiktok.com, mainnet.base.org, myaccount.google.com, oauth2.googleapis.com, pay.clawmoney.ai, platform.claude.com, semver.org, twitter.com, witness.bnbot.ai, www.bilibili.com, www.googleapis.com, www.tiktok.com, www.w3.org, www.youtube.com, x.com

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/companion.jsView file

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/companion.jsView on unpkg · L9

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs'; ... L16: import { loadConfig } from '../utils/config.js'; L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: // Companion source shipped in the npm package: dist/ui/ -> ../../companion ... L21: const RUN_DIR = path.join(os.homedir(), '.clawmoney', 'companion'); L22: const COMPANION_FILES = ['main.js', 'package.json', 'tray-icon.png', 'icon.png', 'icon.icns', 'preload.js']; L23: function copyCompanionFiles() { ... L42: function electronBinaryPath() { L43: if (process.platform === 'darwin') { L44: const dist = path.join(RUN_DIR, 'node_modules', 'electron', 'dist');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/ui/companion.jsView on unpkg · L9

dist/commands/tweet.jsView file

15stdio: 'inherit', L16: shell: true, L17: });

High

Shell

Package source references shell execution.

dist/commands/tweet.jsView on unpkg · L15

dist/relay/upstream/claude-bootstrap.jsView file

284const childEnv = { L285: ...process.env, L286: ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`, L287: NO_PROXY: "127.0.0.1,localhost", ... L295: // users into a lower safety setting without consent. L296: claudeChild = spawn("claude", ["-p", "hi"], { L297: env: childEnv,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/relay/upstream/claude-bootstrap.jsView on unpkg · L284

scripts/probe-claude-api.mjsView file

11L12: import { execFileSync } from "node:child_process"; L13: import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs"; ... L16: import { randomUUID } from "node:crypto"; L17: import { ProxyAgent, setGlobalDispatcher } from "undici"; L18: ... L22: const proxyUrl = L23: process.env.HTTPS_PROXY || L24: process.env.https_proxy || ... L46: L47: const CLAWMONEY_DIR = join(homedir(), ".clawmoney"); L48: const FINGERPRINT_FILE = join(CLAWMONEY_DIR, "claude-fingerprint.json");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

scripts/probe-claude-api.mjsView on unpkg · L11

dist/utils/awal.jsView file

14return new Promise((resolve, reject) => { L15: const child = spawn('npx', ['awal', ...finalArgs], { L16: stdio: ['inherit', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/awal.jsView on unpkg · L14

scripts/install-market-launchd.shView file

•path = scripts/install-market-launchd.sh kind = build_helper sizeBytes = 6489 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-market-launchd.shView on unpkg

companion/icon.icnsView file

•path = companion/icon.icns kind = high_entropy_blob sizeBytes = 714079 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

companion/icon.icnsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-38json

1{

2 "name": "clawmoney",

3 "version": "0.18.2",

4 "description": "ClawMoney CLI -- Earn rewards with your AI agent",

5 "type": "module",

6 "bin": {

7 "clawmoney": "dist/index.js"

8 },

9 "main": "dist/index.js",

10 "files": [

11 "dist",

12 "scripts",

13 "companion"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "dev": "tsc --watch",

18 "postinstall": "node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepublishOnly": "npm run build"

20 },

21 "dependencies": {

22 "@bnbot/cli": "^0.3.0",

23 "@clack/prompts": "^0.7.0",

24 "chalk": "^5.3.0",

25 "commander": "^12.0.0",

26 "ora": "^8.0.0",

27 "viem": "^2.48.1",

28 "ws": "^8.20.0",

29 "yaml": "^2.4.0"

30 },

31 "devDependencies": {

32 "@types/node": "^20.0.0",

33 "@types/ws": "^8.18.1",

34 "typescript": "^5.4.0"

35 },

36 "engines": {

37 "node": ">=18"

38 },

dist/ui/companion.jsView file

Lines 1-29javascript

1// Companion launcher: ensure the Electron companion is installed + running,

2// then talk to it. This is the "reverse-launch" awal does — the CLI brings up

3// the GUI on demand, zero app install for the user.

4//

5// Why a per-user run dir (~/.clawmoney/companion) instead of running straight

6// from the installed package: the global npm package dir is often not writable,

7// and we need to `npm i electron` somewhere. So we copy the tiny companion

8// files into the user's home and install Electron there (awal uses env-paths

9// for the same reason).

10import

dist/commands/tweet.jsView file

Lines 1-30javascript

1import chalk from 'chalk';

2import { spawn } from 'node:child_process';

3/**

4 * Post a tweet by delegating to @bnbot/cli.

5 */

6export async function

dist/relay/upstream/claude-bootstrap.jsView file

Lines 264-304javascript

264 cleanup();

265 reject(new Error(`bootstrap proxy server error: ${err.message}`));

266 });

267 server.listen(0, "127.0.0.1"

scripts/probe-claude-api.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Validate that a locally-logged-in Claude Code OAuth token can be used to

3// call api.anthropic.com directly with the exact headers + body shape Claude

4// Code sends (captured from claude-cli/2.1.100 via ANTHROPIC_LOG=debug).

5//

6// Usage:

7// node scripts/probe-claude-api.mjs # send test request

8// node scripts/probe-claude-api.mjs --refresh # force refresh first

9// node scripts/probe-claude-api.mjs --prompt "hello"

10// node scripts/probe-claude-api.mjs --model claude-sonnet-4-5

dist/utils/awal.jsView file

Lines 1-34javascript

1import { spawn } from 'node:child_process';

2// Windows resolves .cmd / .bat launchers only through the shell;

3// POSIX (macOS/Linux) `spawn` walks PATH on its own and prints a

4// DEP0190 deprecation warning when shell:true is combined with

5// argument arrays. Keep shell:true only where we actually need it.

6const USE_SHELL = process.platform === 'win32'

scripts/install-market-launchd.shView file

•path = scripts/install-market-launchd.sh kind = build_helper sizeBytes = 6489 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-market-launchd.shView on unpkg

companion/icon.icnsView file

•path = companion/icon.icns kind = high_entropy_blob sizeBytes = 714079 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

companion/icon.icnsView on unpkg