iclavue@11.0.35
Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a concrete unsigned remote native-execution capability, but no source evidence establishes malicious intent or an unconsented install-time attack chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Interactive CLI use when no compatible local pager exists, principally on Windows.
Impact
A compromised or redirected package endpoint could yield local code execution.
Mechanism
Unsigned remote native-binary download and execution
AI rationale
The package has a concrete unsigned remote native-execution capability, but no source evidence establishes malicious intent or an unconsented install-time attack chain.
Evidence
package.jsonscripts/postinstall-pager.mjsdist/cli.jsdist/openai-responses-adapter.jsdist/native/clavue-pager-*~/.clavue/native/clavue-pager-<platform>-<arch>
Network endpoints1
www.clavue.com/downloads/native
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli.js downloads a platform native pager from clavue.com at runtime.
- The downloaded pager is written under the user config directory, chmodded, and spawned without checksum/signature verification.
- CLAVUE_PAGER_DOWNLOAD_URL can override the downloaded executable URL.
Evidence against
- package.json postinstall only chmods bundled dist/native/clavue-pager files.
- scripts/postinstall-pager.mjs makes no network requests or config changes.
- Provider credentials in dist/openai-responses-adapter.js are used for configured AI-provider requests; no separate exfiltration path found.
- Settings writes target Clavue-owned .clavue paths and are tied to CLI actions.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-pager.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/mao-command.jsView file
4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos...
L6: `,"utf8"),process4.platform!=="win32")try{fs.chmodSync(filePath,384)}catch{}}__name(defaultWriteJsonFile,"defaultWriteJsonFile");function defaultSafeReadFile(filePath){try{return f...
High
Child Process
Package source references child process execution.
dist/mao-command.jsView on unpkg · L4dist/openai-responses-adapter.jsView file
Findings
1 Critical7 High8 Medium6 Low
CriticalCredential Exfiltrationdist/openai-responses-adapter.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/mao-command.js
HighShell
HighSame File Env Network Executiondist/openai-responses-adapter.js
HighCommand Output Exfiltrationdist/openai-responses-adapter.js
HighCloud Metadata Accessdist/openai-responses-adapter.js
HighSemantic Analysis Limiteddist/openai-responses-adapter.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/native/clavue-pager-darwin-x64
Medium
Affected versions and remediation
This report applies to iclavue@11.0.35.
See all versions of iclavue for other recorded verdicts.
- Review the evidence and your use of iclavue@11.0.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.