registry / Remote code execution / iclavue / 11.3.13

iclavue@11.3.13

Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection found a deferred, unverified native-binary delivery path, not a concrete install-time malicious chain. Warn rather than block because the capability is runtime-gated and package-aligned.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs the interactive clavue CLI on Windows without a cached pager.

Impact

A compromised vendor endpoint or inherited download-URL environment variable could supply code that the CLI later executes.

Mechanism

Deferred download and execution preparation of a native pager binary.

AI rationale

Evidence

package.jsonscripts/postinstall-pager.mjsdist/cli.jsdist/openai-responses-adapter.jsdist/clavue.jsinstall.shrepair.shdist/native/clavue-pager-*

Network endpoints1

www.clavue.com/downloads/native

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Install hook chmods every dist/native/clavue-pager* file.
Hook states Windows first launch downloads a native UI executable.
Runtime source permits an environment-supplied pager download URL and otherwise uses https://www.clavue.com/downloads/native.

Evidence against

postinstall performs no network request or child-process execution.
The deferred download is limited to interactive Windows runtime; it is not an install-time payload fetch.
No inspected source showed credential harvesting or foreign AI-agent config mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 868 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.clavue.com, api.deepseek.com, api.example.com, api.kimi.com, api.minimaxi.com, json-schema.org, open.bigmodel.cn, openrouter.ai, www.clavue.com

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/mao-command.jsView file

4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos... L6: `,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.writeFileSync(tmpPath,payload,"utf8"),fs.renameSync(tmpPath,filePath)}catc...

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = iclavue@11.3.5 matchedPath = dist/mao-command.js matchedIdentity = npm:aWNsYXZ1ZQ:11.3.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mao-command.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0c8307e77f6c9f4b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = iclavue@11.3.5 matchedPath = dist/mao-command.js matchedIdentity = npm:aWNsYXZ1ZQ:11.3.5 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/mao-command.jsView on unpkg

dist/openai-responses-adapter.jsView file

3// clavue v11.3.13 openai-responses-adapter (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: /* [wrapped with `+details+`] */ ... L22: `)+source+`return __p L23: }`;var result2=attempt_default(function(){return Function(importsKeys,sourceURL+"return "+source).apply(void 0,importsValues)});if(result2.source=source,isError_default(result2))th... L24: `):[]}};_LineDecoder_buffer=new WeakMap,_LineDecoder_carriageReturnIndex=new WeakMap;LineDecoder.NEWLINE_CHARS=new Set([` ... L61: new Anthropic({ apiKey, dangerouslyAllowBrowser: true }); L62: `);this.baseURL=options.baseURL,this.timeout=options.timeout??_a.DEFAULT_TIMEOUT,this.lo

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/openai-responses-adapter.jsView on unpkg · L3

75`)===-1){debug3("have not received end of HTTP headers yet..."),read();return}let firstLine=buffered.toString("ascii",0,buffered.indexOf(`\r L76: `)),statusCode=+firstLine.split(" ")[1];debug3("got proxy server response: %o",firstLine),resolve9({statusCode,buffered})}__name(ondata,"ondata"),socket.on("error",onerror),socket.... L77: `;proxy.auth&&(headers["Proxy-Authorization"]=`Basic ${Buffer.from(proxy.auth).toString("base64")}`);let{host,port,secureEndpoint}=opts;isDefaultPort(port,secureEndpoint)||(host+=`... ... L79: `);let{statusCode,buffered}=yield proxyResponsePromise;if(statusCode===200){if(req.once("socket",resume2),opts.secureEndpoint){debug3("Upgrading socket connection to TLS");let serv... L80: `,CRLF_BYTES=textEncoder.encode(CRLF),CRLF_BYTES_COUNT=2,FormDataPart=class{st

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openai-responses-adapter.js

dist/native/clavue-pager-darwin-x64View file

•path = dist/native/clavue-pager-darwin-x64 kind = native_binary sizeBytes = 5348840 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-darwin-x64View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6630 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 17508869 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17508869 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/provider-setup.jsView file

•matchType = normalized_sha256 matchedPackage = iclavue@11.3.5 matchedPath = dist/provider-setup.js matchedIdentity = npm:aWNsYXZ1ZQ:11.3.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-setup.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/mao-command.jsView file

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

Findings

1 Critical11 High8 Medium6 Low

CriticalCredential Exfiltrationdist/openai-responses-adapter.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/mao-command.js

HighShell

HighSame File Env Network Executiondist/openai-responses-adapter.js

HighCommand Output Exfiltrationdist/openai-responses-adapter.js

HighCloud Metadata Accessdist/openai-responses-adapter.js

HighSemantic Analysis Limiteddist/openai-responses-adapter.js

HighKnown Malware Source Similaritydist/mao-command.js

HighKnown Malware Source Similaritydist/openai-responses-adapter.js

HighKnown Malware Source Similaritydist/provider-setup.js

Affected versions and remediation

This report applies to iclavue@11.3.13.

See all versions of iclavue for other recorded verdicts.

Review the evidence and your use of iclavue@11.3.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 03:46:16.258Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code