registry / clawnify / 0.6.1

clawnify@0.6.1

⚠ Under review

Deploy your apps and website to Clawnify from the terminal with Claude Code, Codex, and Cursor

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 129 KB of source, external domains: app.clawnify.com, auth.clawnify.com, clawnify-mcp-docs.workers.dev, docs.astro.build, github.com, mcp.clawnify.com, nodejs.org, provision.clawnify.com

Source & flagged code

4 flagged

dist/chunk-HOCFYU72.jsView file

Lines 156-196javascript

156 orgId

157 });

158}

159async function listMyOrgs() {

160 const auth = await requireAuth();

161 const res = await apiRequest("GET", "/v1/orgs", { token: auth.access_token });

162 if (!res.ok) return [];

163 const { orgs } = await res.json();

164 return orgs ?? [];

165}

166var api = {

167 get: (path4, opts) => authedRequest("GET", path4, opts),

168 post: (path4, body, opts) => authedRequest("POST", path4, { body, ...opts }),

169 postForm: (path4, formData, opts) => authedRequest("POST", path4, { formData, ...opts }),

170 del: (path4, opts) => authedRequest("DELETE", path4, opts),

171 request: apiRequest

172};

173

174// src/lib/archive.ts

175import fs2 from "fs";

176import path2 from "path";

177import { execSync } from "child_process";

178import { gzipSync } from "zlib";

High

Child Process

Package source references child process execution.

dist/chunk-HOCFYU72.jsView on unpkg · L176

179var EXCLUDE_DIRS = /* @__PURE__ */ new Set([

180 "node_modules",

181 ".git",

182 "dist",

183 ".next",

184 ".clawnify",

185 "build"

186]);

187var MAX_SIZE = 20 * 1024 * 1024;

188function runGit(args, dir) {

189 try {

190 return execSync(`git ${args.join(" ")}`, {

191 cwd: dir,

192 encoding: "utf-8",

193 stdio: ["pipe", "pipe", "pipe"]

194 });

195 } catch {

196 return null;

dist/cli-OQPC6TYM.jsView file

Lines 7-47javascript

7 createArchive,

8 findWorkspaceRoot,

9 generatePkce,

10 getEmailFromToken,

11 getValidToken,

12 listMyOrgs,

13 loadAuth,

14 manifestKind,

15 pollUntilReady,

16 readManifest,

17 readProject,

18 readWorkspaceConfig,

19 saveAuth,

Source & flagged code

4 flagged · loading source

dist/chunk-HOCFYU72.jsView file

176import path2 from "path"; L177: import { execSync } from "child_process"; L178: import { gzipSync } from "zlib";

High

Child Process

Package source references child process execution.

dist/chunk-HOCFYU72.jsView on unpkg · L176

dist/cli-OQPC6TYM.jsView file

27import crypto from "crypto"; L28: import http from "http"; L29: import readline from "readline"; ... L52: res.writeHead(404); L53: res.end("Not found"); L54: return; ... L88: if (!tokenRes.ok) { L89: const err = await tokenRes.text(); L90: throw new Error(`Token exchange failed: ${err}`); ... L149: input: process.stdin, L150: output: process.stdout L151: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli-OQPC6TYM.jsView on unpkg · L27

27Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/cli-OQPC6TYM.js L27: import crypto from "crypto"; L28: import http from "http"; L29: import readline from "readline"; ... L52: res.writeHead(404); L53: res.end("Not found"); L54: return; ... L88: if (!tokenRes.ok) { L89: const err = await tokenRes.text(); L90: throw new Error(`Token exchange failed: ${err}`); ... L149: input: process.stdin, L150: output: process.stdout L151: });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli-OQPC6TYM.jsView on unpkg · L27

697await new Promise((resolve) => { L698: const proc = spawn("npx", ["drizzle-kit", "generate"], { L699: cwd: resolvedDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-OQPC6TYM.jsView on unpkg · L697

Findings

2 Critical3 High3 Medium5 Low

CriticalCredential Exfiltrationdist/cli-OQPC6TYM.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli-OQPC6TYM.js

HighChild Processdist/chunk-HOCFYU72.js

HighShell

HighRuntime Package Installdist/cli-OQPC6TYM.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/chunk-HOCFYU72.jsView file

Lines 156-196javascript

156 orgId

157 });

158}

159async function listMyOrgs() {

160 const auth = await requireAuth();

161 const res = await apiRequest("GET", "/v1/orgs", { token: auth.access_token });

162 if (!res.ok) return [];

163 const { orgs } = await res.json();

164 return orgs ?? [];

165}

166var api = {

167 get: (path4, opts) => authedRequest("GET", path4, opts),

168 post: (path4, body, opts) => authedRequest("POST", path4, { body, ...opts }),

169 postForm: (path4, formData, opts) => authedRequest("POST", path4, { formData, ...opts }),

170 del: (path4, opts) => authedRequest("DELETE", path4, opts),

171 request: apiRequest

172};

173

174// src/lib/archive.ts

175import fs2 from "fs";

176import path2 from "path";

177import { execSync } from "child_process";

178import { gzipSync } from "zlib";

High

Child Process

Package source references child process execution.

dist/chunk-HOCFYU72.jsView on unpkg · L176

179var EXCLUDE_DIRS = /* @__PURE__ */ new Set([

180 "node_modules",

181 ".git",

182 "dist",

183 ".next",

184 ".clawnify",

185 "build"

186]);

187var MAX_SIZE = 20 * 1024 * 1024;

188function runGit(args, dir) {

189 try {

190 return execSync(`git ${args.join(" ")}`, {

191 cwd: dir,

192 encoding: "utf-8",

193 stdio: ["pipe", "pipe", "pipe"]

194 });

195 } catch {

196 return null;

dist/cli-OQPC6TYM.jsView file

Lines 7-47javascript

7 createArchive,

8 findWorkspaceRoot,

9 generatePkce,

10 getEmailFromToken,

11 getValidToken,

12 listMyOrgs,

13 loadAuth,

14 manifestKind,

15 pollUntilReady,

16 readManifest,

17 readProject,

18 readWorkspaceConfig,

19 saveAuth,

Lines 677-717javascript

677 console.log(

678 ` ${rel} differs from the deployed copy (not in git).

679 Run \`clawnify pull schema --force --from ${slug}\` to overwrite.

680`

681 );

682 break;

683 case "no-schema":

684 case "unchanged":

685 break;

686 }

687 } catch (err) {

688 console.log(` (schema sync skipped: ${err.message})

689`);

690 }

691 }

692}

693async function regenerateDrizzleMigrations(resolvedDir) {

694 const schemaTs = path2.join(resolvedDir, "src/server/schema.ts");

695 const drizzleConfig = path2.join(resolvedDir, "drizzle.config.ts");

696 if (!fs2.existsSync(schemaTs) || !fs2.existsSync(drizzleConfig)) return;

697 await new Promise((resolve) => {

698 const proc = spawn("npx", ["drizzle-kit", "generate"], {

699 cwd: resolvedDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-OQPC6TYM.jsView on unpkg · L697

700 stdio: ["ignore", "pipe", "pipe"],

701 env: { ...process.env }

702 });

703 let stderr = "";

704 proc.stderr?.on("data", (d) => {

705 stderr += d.toString();

706 });

707 proc.on("exit", (code) => {

708 if (code !== 0) {

709 console.warn(

710 ` warning: drizzle-kit generate failed (${stderr.trim().slice(0, 200)}). Continuing with existing .clawnify/drizzle/ contents.`

711 );

712 }

713 resolve();

714 });

715 proc.on("error", () => resolve());

716 });

717}