Loading npm security reports…

forge-openclaw-plugin@0.3.48: Suspicious npm security report | LPM Firewall

registry / forge-openclaw-plugin / 0.3.48

forge-openclaw-plugin@0.3.48

Curated OpenClaw adapter for the Forge collaboration API, UI entrypoint, and localhost auto-start runtime.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The OpenClaw extension activates on host startup for localhost configuration, starts a Forge runtime, and injects Forge-derived context into agent sessions. It also contains guarded first-party peer-daemon lifecycle support. No unconsented npm install hook, foreign agent-control mutation, or credential exfiltration was confirmed.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

OpenClaw startup with a localhost Forge origin; agent bootstrap; configured peer-daemon use.

Impact

Starts local services, may install missing package dependencies at runtime, and exposes configured Forge context to agent sessions.

Mechanism

First-party OpenClaw runtime bootstrap, context injection, and optional detached peer daemon.

Rationale

Source confirms a powerful first-party OpenClaw lifecycle integration, including runtime installation and context injection, so it warrants a warning. The scanner's credential-exfiltration and high-entropy-blob claims were not substantiated by direct inspection.

Evidence

package.jsonopenclaw.plugin.jsondist/openclaw/local-runtime.jsdist/openclaw/session-bootstrap.jsdist/openclaw/plugin-entry-shared.jsdist/server/apps/api/src/services/peer-daemon-supervisor.jsdist/server/apps/api/src/health-weight-loss.js~/.openclaw/run/forge-openclaw-plugin~/.openclaw/logs/forge-openclaw-plugin

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/openclaw/local-runtime.js` starts on localhost host startup and can run `npm install --ignore-scripts` for missing runtime dependencies.
`dist/openclaw/local-runtime.js` spawns the bundled Forge server and writes runtime state/log files under `~/.openclaw`.
`dist/openclaw/session-bootstrap.js` fetches Forge context and injects it into each eligible OpenClaw agent bootstrap as `.forge/generated/FORGE_SESSION_BOOTSTRAP.md`.
`dist/server/apps/api/src/services/peer-daemon-supervisor.js` can launch a detached `forge-peer` daemon with optional Tor/mailbox networking.

Evidence against

`package.json` contains no npm `preinstall`, `install`, or `postinstall` lifecycle script.
Local runtime autostart is limited to localhost origins; remote targets skip the bootstrap service.
Runtime dependency installation explicitly uses `--ignore-scripts`.
`health-weight-loss.js` has no credential-harvesting logic; its external calls are nutrition lookup and configured ChatGPT integration endpoints.
`dist/favicon.ico` is a normal Windows icon resource, not an opaque executable payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 366 file(s), 12.4 MB of source, external domains: 127.0.0.1, accounts.google.com, api.nal.usda.gov, api.open-meteo.com, api.openai.com, apidata.googleusercontent.com, auth.openai.com, bit.ly, caldav.example.com, caldav.icloud.com, calendar.example, cdn.who.int, chatgpt.com, console.cloud.google.com, developers.google.com, example.com, forge.local, github.com, graph.microsoft.com, iris.who.int, learn.microsoft.com, login.microsoftonline.com, maplibre.org, mhpssknowledgehub.sph.cuny.edu, oauth2.googleapis.com, open.spotify.com, openclaw.local, openidconnect.googleapis.com, pro.reactflow.dev, radix-ui.com, react-dnd.github.io, react.dev, reactflow.dev, reactjs.org, redux-toolkit.js.org, redux.js.org, support.apple.com, tile.openstreetmap.org, world.openfoodfacts.org, www.anima.com.au, www.apple.com, www.googleapis.com, www.phqscreeners.com, www.ptsd.va.gov, www.w3.org, www.who.int

Source & flagged code

8 flagged · loading source

dist/openclaw/local-runtime.jsView file

1import { spawn } from "node:child_process"; L2: import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/openclaw/local-runtime.jsView on unpkg · L1

509const enableManagedDevWeb = shouldEnableManagedDevWeb(plan); L510: const child = spawn(process.execPath, args, { L511: cwd: plan.packageRoot, L512: env: { L513: ...process.env, L514: HOST: "127.0.0.1", ... L518: ? { L519: FORGE_DEV_WEB_ORIGIN: process.env.FORGE_DEV_WEB_ORIGIN ?? "http://127.0.0.1:3027/forge/" L520: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openclaw/local-runtime.jsView on unpkg · L509

dist/server/apps/api/src/web.jsView file

86env: input.env, L87: shell: true L88: };

High

Shell

Package source references shell execution.

dist/server/apps/api/src/web.jsView on unpkg · L86

dist/assets/graph-C-DM16tc.jsView file

317`,hl=ll,Vo=WebGLRenderingContext,er=Vo.UNSIGNED_BYTE,lt=Vo.FLOAT,fl=["u_matrix","u_zoomRatio","u_sizeRatio","u_correctionRatio","u_pixelRatio","u_feather","u_minEdgeThickness"],gl=... L318: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ur(e){return Hl(e)||jl(e)||Ro(e)||Vl()}function Wl(e,t){if(e==null)return{};var n={};f...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/graph-C-DM16tc.jsView on unpkg · L317

dist/openclaw/session-registry.jsView file

52path: "/api/v1/agents/sessions", L53: body: { L54: provider: SESSION_PROVIDER, L55: agentLabel: process.env.FORGE_AGENT_LABEL?.trim() || DEFAULT_RUNTIME_AGENT_LABEL, L56: agentType: SESSION_PROVIDER,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/openclaw/session-registry.jsView on unpkg · L52

dist/server/apps/api/src/health-weight-loss.jsView file

265if (!candidate) { L266: return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC"; L267: } ... L309: try { L310: const parsed = JSON.parse(value); L311: return parsed ?? fallback; ... L2174: async function searchOpenFoodFacts(query, limit) { L2175: const url = new URL("https://world.openfoodfacts.org/cgi/search.pl"); L2176: url.searchParams.set("search_terms", query); ... L2192: async function lookupOpenFoodFactsBarcode(barcode) { L2193: const response = await fetch(`https://world.openfoodfacts.org/api/v2/product/${encodeURIComponent(barcode)}.json`, { headers: { accept: "application/json" } }); L2194: if (!response.ok) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server/apps/api/src/health-weight-loss.jsView on unpkg · L265

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 12681 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg

dist/server/apps/api/src/services/peer-daemon-supervisor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = forge-openclaw-plugin@0.3.32 matchedIdentity = npm:Zm9yZ2Utb3BlbmNsYXctcGx1Z2lu:0.3.32 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/apps/api/src/services/peer-daemon-supervisor.jsView on unpkg

Source & flagged code

8 flagged

dist/openclaw/local-runtime.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/openclaw/local-runtime.jsView on unpkg · L1

3import net from "node:net";

4import { homedir } from "node:os";

5import path from "node:path";

6import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";

7import { fileURLToPath } from "node:url";

8const LOCAL_HOSTNAMES = new Set(["127.0.0.1", "localhost", "::1"]);

9const STARTUP_TIMEOUT_MS = 15_000;

10const HEALTHCHECK_TIMEOUT_MS = 1_500;

11const HEALTHCHECK_INTERVAL_MS = 250;

12const EXISTING_RUNTIME_GRACE_MS = 3_000;

13const MAX_PORT_SCAN_ATTEMPTS = 20;

14const FORGE_PLUGIN_ID = "forge-openclaw-plugin";

15let managedRuntimeChild = null;

16let managedRuntimeKey = null;

17let managedRuntimeLogPath = null;

18let lastRuntimeExitDetails = null;

19let startupPromise = null;

20let startupRuntimeKey = null;

21const dependencyInstallPromises = new Map();

Lines 489-529javascript

489 return { healthy: false, pid: null, storageRoot: null, basePath: null };

490 }

491 finally {

492 clearTimeout(timeout);

493 }

494}

495async function

dist/server/apps/api/src/web.jsView file

Lines 66-106javascript

66 return value && value.length > 0 ? value : "npm run dev:web";

67}

68function getDefaultDevWebOriginPort(origin) {

dist/assets/graph-C-DM16tc.jsView file

Lines 297-319javascript

297 // For the fragment shader though, we need a thickness that takes the "magic"

298 // correction ratio into account (as in webGLThickness), but so that the

299 // antialiasing effect does not depend on the zoom level. So here's yet

300 // another thickness version:

301 v_thickness = webGLThickness / u_zoomRatio;

302

303 v_normal = unitNormal;

dist/openclaw/session-registry.jsView file

Lines 32-72javascript

32 return normalized;

33 }

34 return `${normalized.slice(0, Math.max(0, limit - 1

dist/server/apps/api/src/health-weight-loss.jsView file

Lines 245-285javascript

245export const nutritionExperimentPatchSchema = nutritionExperimentCreateSchema

246 .omit({ userId: true })

247 .partial()

248 .extend({ conclusion: z.string().trim

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 12681 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg

dist/server/apps/api/src/services/peer-daemon-supervisor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = forge-openclaw-plugin@0.3.32 matchedIdentity = npm:Zm9yZ2Utb3BlbmNsYXctcGx1Z2lu:0.3.32 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/apps/api/src/services/peer-daemon-supervisor.jsView on unpkg