registry / Remote code execution / iclavue
iclavue
Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery
This report shows the evidence for iclavue@11.3.5. 2 of 111 known versions are blocked or flagged. The newest version, 13.9.0, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe install hook itself is limited, but the user-invoked runtime contains an unchecked remote executable download-and-execution chain. This is concrete remote payload execution, not merely ordinary API traffic.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Interactive CLI/pager launch on Windows by default, or CLAVUE_FORCE_NATIVE_DOWNLOAD=1.
Impact
Remote content can become locally executable code.
Mechanism
Remote native-binary download, chmod, and execution path.
Attack narrative
The interactive CLI resolves a missing pager by downloading a platform executable from a configurable URL, writing it into the user configuration directory, and marking it executable. There is no source-visible signature, hash, or other integrity validation in this path. The resolver returns that downloaded binary for the pager launch flow, creating a concrete remote-code execution chain outside npm package integrity protections.
AI rationale
The install hook itself is limited, but the user-invoked runtime contains an unchecked remote executable download-and-execution chain. This is concrete remote payload execution, not merely ordinary API traffic.
Evidence
package.jsonscripts/postinstall-pager.mjsdist/clavue.jsdist/cli.js~/.clavue/native/clavue-pager-<platform>-<arch>
Network endpoints1
www.clavue.com/downloads/native
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Interactive runtime downloads a native executable from clavue.com.
- The download URL is overrideable by environment variables.
- Downloaded bytes are saved and chmodded executable with no integrity verification.
- Resolver returns the downloaded pager binary for later execution.
Evidence against
- postinstall only chmods bundled pager files and performs no network request.
- The remote download is runtime-gated to Windows by default, not install-time.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-pager.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/mao-command.jsView file
4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos...
L6: `,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.writeFileSync(tmpPath,payload,"utf8"),fs.renameSync(tmpPath,filePath)}catc...
High
Child Process
Package source references child process execution.
dist/mao-command.jsView on unpkg · L4•matchType = normalized_sha256
matchedPackage = iclavue@11.0.12
matchedPath = dist/mao-command.js
matchedIdentity = npm:aWNsYXZ1ZQ:11.0.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
1 Critical10 High8 Medium6 Low
CriticalCredential Exfiltrationdist/openai-responses-adapter.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/mao-command.js
HighShell
HighSame File Env Network Executiondist/openai-responses-adapter.js
HighCommand Output Exfiltrationdist/openai-responses-adapter.js
HighCloud Metadata Accessdist/openai-responses-adapter.js
HighSemantic Analysis Limiteddist/openai-responses-adapter.js
HighKnown Malware Source Similaritydist/mao-command.js
HighKnown Malware Source Similaritydist/openai-responses-adapter.js
HighKnown Malware Source Similaritydist/provider-setup.js
Affected versions and remediation
This report applies to iclavue@11.3.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing iclavue@11.3.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.