registry / clawnify / 0.7.1

clawnify@0.7.1

⚠ Under review

Deploy your apps and website to Clawnify from the terminal with Claude Code, Codex, and Cursor

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 128 KB of source, external domains: 127.0.0.1, app.clawnify.com, auth.clawnify.com, clawnify-mcp-docs.workers.dev, docs.astro.build, github.com, mcp.clawnify.com, nodejs.org, provision.clawnify.com

Source & flagged code

4 flagged

dist/cli-L7TPOLHI.jsView file

Lines 7-47javascript

7 createArchive,

8 findWorkspaceRoot,

9 generatePkce,

10 getEmailFromToken,

11 getValidToken,

12 listMyOrgs,

13 loadAuth,

14 manifestKind,

15 pollUntilReady,

16 readManifest,

17 readProject,

18 readWorkspaceConfig,

19 saveAuth,

20 saveProject

21} from "./chunk-HOCFYU72.js";

23// src/cli.ts

24import { Command } from "commander";

26// src/commands/login.ts

27import crypto from "crypto";

28import http from "http";

29import readline from "readline";

30import open from "open";

31var CALLBACK_PORT = 19823;

32var REDIRECT_URI = "https://app.clawnify.com/oauth/cli";

33var WEB_ORIGIN = "https://app.clawnify.com";

34function waitForCode(state) {

35 return new Promise((resolve, reject) => {

36 let done = false;

37 let rl = null;

38 const server = http.createServer((req, res) => {

39 const url = new URL(req.url, `http://127.0.0.1:${CALLBACK_PORT}`);

40 const corsHeaders = {

41 "Access-Control-Allow-Origin": WEB_ORIGIN,

42 "Access-Control-Allow-Methods": "GET, OPTIONS",

43 "Access-Control-Allow-Private-Network": "true"

44 };

45 if (req.method === "OPTIONS") {

46 res.writeHead(204, corsHeaders);

47 res.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli-L7TPOLHI.jsView on unpkg · L27

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli-L7TPOLHI.jsView on unpkg · L27

Lines 134-174javascript

134 let email = "unknown";

135 try {

136 const payload = JSON.parse(

137 Buffer.from(result.access_token.split(".")[1], "base64").toString()

138 );

139 email

Lines 649-689javascript

649 console.log(

650 ` ${rel} differs from the deployed copy (not in git).

651 Run \`clawnify pull schema --force --from ${slug}\` to overwrite.

652`

653 );

654 break;

655 case "no-schema":

656 case "unchanged":

Source & flagged code

4 flagged · loading source

dist/cli-L7TPOLHI.jsView file

27import crypto from "crypto"; L28: import http from "http"; L29: import readline from "readline"; ... L42: "Access-Control-Allow-Methods": "GET, OPTIONS", L43: "Access-Control-Allow-Private-Network": "true" L44: }; ... L46: res.writeHead(204, corsHeaders); L47: res.end(); L48: return; ... L82: input: process.stdin, L83: output: process.stdout L84: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli-L7TPOLHI.jsView on unpkg · L27

27Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/cli-L7TPOLHI.js L27: import crypto from "crypto"; L28: import http from "http"; L29: import readline from "readline"; ... L42: "Access-Control-Allow-Methods": "GET, OPTIONS", L43: "Access-Control-Allow-Private-Network": "true" L44: }; ... L46: res.writeHead(204, corsHeaders); L47: res.end(); L48: return; ... L82: input: process.stdin, L83: output: process.stdout L84: });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli-L7TPOLHI.jsView on unpkg · L27

154import readline2 from "readline"; L155: import { spawn } from "child_process"; L156:

High

Child Process

Package source references child process execution.

dist/cli-L7TPOLHI.jsView on unpkg · L154

669await new Promise((resolve) => { L670: const proc = spawn("npx", ["drizzle-kit", "generate"], { L671: cwd: resolvedDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-L7TPOLHI.jsView on unpkg · L669

Findings

2 Critical3 High3 Medium5 Low

CriticalCredential Exfiltrationdist/cli-L7TPOLHI.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli-L7TPOLHI.js

HighChild Processdist/cli-L7TPOLHI.js

HighShell

HighRuntime Package Installdist/cli-L7TPOLHI.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli-L7TPOLHI.jsView file

Lines 7-47javascript

7 createArchive,

8 findWorkspaceRoot,

9 generatePkce,

10 getEmailFromToken,

11 getValidToken,

12 listMyOrgs,

13 loadAuth,

14 manifestKind,

15 pollUntilReady,

16 readManifest,

17 readProject,

18 readWorkspaceConfig,

19 saveAuth,

20 saveProject

21} from "./chunk-HOCFYU72.js";

23// src/cli.ts

24import { Command } from "commander";

26// src/commands/login.ts

27import crypto from "crypto";

28import http from "http";

29import readline from "readline";

30import open from "open";

31var CALLBACK_PORT = 19823;

32var REDIRECT_URI = "https://app.clawnify.com/oauth/cli";

33var WEB_ORIGIN = "https://app.clawnify.com";

34function waitForCode(state) {

35 return new Promise((resolve, reject) => {

36 let done = false;

37 let rl = null;

38 const server = http.createServer((req, res) => {

39 const url = new URL(req.url, `http://127.0.0.1:${CALLBACK_PORT}`);

40 const corsHeaders = {

41 "Access-Control-Allow-Origin": WEB_ORIGIN,

42 "Access-Control-Allow-Methods": "GET, OPTIONS",

43 "Access-Control-Allow-Private-Network": "true"

44 };

45 if (req.method === "OPTIONS") {

46 res.writeHead(204, corsHeaders);

47 res.end();

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli-L7TPOLHI.jsView on unpkg · L27

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli-L7TPOLHI.jsView on unpkg · L27

Lines 134-174javascript

134 let email = "unknown";

135 try {

136 const payload = JSON.parse(

137 Buffer.from(result.access_token.split(".")[1], "base64").toString()

138 );

139 email

Lines 649-689javascript

649 console.log(

650 ` ${rel} differs from the deployed copy (not in git).

651 Run \`clawnify pull schema --force --from ${slug}\` to overwrite.

652`

653 );

654 break;

655 case "no-schema":

656 case "unchanged":