registry / clawnify / 0.7.0

clawnify@0.7.0

⚠ Under review

Deploy your apps and website to Clawnify from the terminal with Claude Code, Codex, and Cursor

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 130 KB of source, external domains: 127.0.0.1, app.clawnify.com, auth.clawnify.com, clawnify-mcp-docs.workers.dev, docs.astro.build, github.com, mcp.clawnify.com, nodejs.org, provision.clawnify.com

Source & flagged code

4 flagged

dist/chunk-HOCFYU72.jsView file

Lines 156-196javascript

156 orgId

157 });

158}

159async function listMyOrgs() {

160 const auth = await requireAuth();

161 const res = await apiRequest("GET", "/v1/orgs", { token: auth.access_token });

162 if (!res.ok) return [];

163 const { orgs } = await res.json();

164 return orgs ?? [];

165}

166var api = {

167 get: (path4, opts) => authedRequest("GET", path4, opts),

168 post: (path4, body, opts) => authedRequest("POST", path4, { body, ...opts }),

169 postForm: (path4, formData, opts) => authedRequest("POST", path4, { formData, ...opts }),

170 del: (path4, opts) => authedRequest("DELETE", path4, opts),

171 request: apiRequest

172};

173

174// src/lib/archive.ts

175import fs2 from "fs";

176import path2 from "path";

177import { execSync } from "child_process";

178import { gzipSync } from "zlib";

High

Child Process

Package source references child process execution.

dist/chunk-HOCFYU72.jsView on unpkg · L176

179var EXCLUDE_DIRS = /* @__PURE__ */ new Set([

180 "node_modules",

181 ".git",

182 "dist",

183 ".next",

184 ".clawnify",

185 "build"

186]);

187var MAX_SIZE = 20 * 1024 * 1024;

188function runGit(args, dir) {

189 try {

190 return execSync(`git ${args.join(" ")}`, {

191 cwd: dir,

192 encoding: "utf-8",

193 stdio: ["pipe", "pipe", "pipe"]

194 });

195 } catch {

196 return null;

dist/cli-KCTCHVPG.jsView file

Lines 7-47javascript

7 createArchive,

8 findWorkspaceRoot,

9 generatePkce,

10 getEmailFromToken,

11 getValidToken,

12 listMyOrgs,

13 loadAuth,

14 manifestKind,

15 pollUntilReady,

16 readManifest,

17 readProject,

18 readWorkspaceConfig,

19 saveAuth,

Source & flagged code

4 flagged · loading source

dist/chunk-HOCFYU72.jsView file

176import path2 from "path"; L177: import { execSync } from "child_process"; L178: import { gzipSync } from "zlib";

High

Child Process

Package source references child process execution.

dist/chunk-HOCFYU72.jsView on unpkg · L176

dist/cli-KCTCHVPG.jsView file

27import crypto from "crypto"; L28: import http from "http"; L29: import readline from "readline"; ... L42: "Access-Control-Allow-Methods": "GET, OPTIONS", L43: "Access-Control-Allow-Private-Network": "true" L44: }; ... L46: res.writeHead(204, corsHeaders); L47: res.end(); L48: return; ... L82: input: process.stdin, L83: output: process.stdout L84: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli-KCTCHVPG.jsView on unpkg · L27

27Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/cli-KCTCHVPG.js L27: import crypto from "crypto"; L28: import http from "http"; L29: import readline from "readline"; ... L42: "Access-Control-Allow-Methods": "GET, OPTIONS", L43: "Access-Control-Allow-Private-Network": "true" L44: }; ... L46: res.writeHead(204, corsHeaders); L47: res.end(); L48: return; ... L82: input: process.stdin, L83: output: process.stdout L84: });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli-KCTCHVPG.jsView on unpkg · L27

711await new Promise((resolve) => { L712: const proc = spawn("npx", ["drizzle-kit", "generate"], { L713: cwd: resolvedDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-KCTCHVPG.jsView on unpkg · L711

Findings

2 Critical3 High3 Medium5 Low

CriticalCredential Exfiltrationdist/cli-KCTCHVPG.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli-KCTCHVPG.js

HighChild Processdist/chunk-HOCFYU72.js

HighShell

HighRuntime Package Installdist/cli-KCTCHVPG.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/chunk-HOCFYU72.jsView file

Lines 156-196javascript

156 orgId

157 });

158}

159async function listMyOrgs() {

160 const auth = await requireAuth();

161 const res = await apiRequest("GET", "/v1/orgs", { token: auth.access_token });

162 if (!res.ok) return [];

163 const { orgs } = await res.json();

164 return orgs ?? [];

165}

166var api = {

167 get: (path4, opts) => authedRequest("GET", path4, opts),

168 post: (path4, body, opts) => authedRequest("POST", path4, { body, ...opts }),

169 postForm: (path4, formData, opts) => authedRequest("POST", path4, { formData, ...opts }),

170 del: (path4, opts) => authedRequest("DELETE", path4, opts),

171 request: apiRequest

172};

173

174// src/lib/archive.ts

175import fs2 from "fs";

176import path2 from "path";

177import { execSync } from "child_process";

178import { gzipSync } from "zlib";

High

Child Process

Package source references child process execution.

dist/chunk-HOCFYU72.jsView on unpkg · L176

179var EXCLUDE_DIRS = /* @__PURE__ */ new Set([

180 "node_modules",

181 ".git",

182 "dist",

183 ".next",

184 ".clawnify",

185 "build"

186]);

187var MAX_SIZE = 20 * 1024 * 1024;

188function runGit(args, dir) {

189 try {

190 return execSync(`git ${args.join(" ")}`, {

191 cwd: dir,

192 encoding: "utf-8",

193 stdio: ["pipe", "pipe", "pipe"]

194 });

195 } catch {

196 return null;

dist/cli-KCTCHVPG.jsView file

Lines 7-47javascript

7 createArchive,

8 findWorkspaceRoot,

9 generatePkce,

10 getEmailFromToken,

11 getValidToken,

12 listMyOrgs,

13 loadAuth,

14 manifestKind,

15 pollUntilReady,

16 readManifest,

17 readProject,

18 readWorkspaceConfig,

19 saveAuth,

Lines 691-731javascript

691 console.log(

692 ` ${rel} differs from the deployed copy (not in git).

693 Run \`clawnify pull schema --force --from ${slug}\` to overwrite.

694`

695 );

696 break;

697 case "no-schema":

698 case "unchanged":

699 break;

700 }

701 } catch (err) {

702 console.log(` (schema sync skipped: ${err.message})

703`);

704 }

705 }

706}

707async function regenerateDrizzleMigrations(resolvedDir) {

708 const schemaTs = path2.join(resolvedDir, "src/server/schema.ts");

709 const drizzleConfig = path2.join(resolvedDir, "drizzle.config.ts");

710 if (!fs2.existsSync(schemaTs) || !fs2.existsSync(drizzleConfig)) return;

711 await new Promise((resolve) => {

712 const proc = spawn("npx", ["drizzle-kit", "generate"], {

713 cwd: resolvedDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-KCTCHVPG.jsView on unpkg · L711

714 stdio: ["ignore", "pipe", "pipe"],

715 env: { ...process.env }

716 });

717 let stderr = "";

718 proc.stderr?.on("data", (d) => {

719 stderr += d.toString();

720 });

721 proc.on("exit", (code) => {

722 if (code !== 0) {

723 console.warn(

724 ` warning: drizzle-kit generate failed (${stderr.trim().slice(0, 200)}). Continuing with existing .clawnify/drizzle/ contents.`

725 );

726 }

727 resolve();

728 });

729 proc.on("error", () => resolve());

730 });

731}