registry / Remote code execution / iclavue / 11.3.15

iclavue@11.3.15

Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection found an unsigned remote native-binary delivery and execution path, but no concrete install-time malware, credential theft, or foreign agent-control mutation. This is a real high-impact supply-chain capability that warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user launches the CLI in pager mode on Windows when no local pager binary is available.

Impact

A compromised vendor download endpoint could obtain code execution with the invoking user's permissions.

Mechanism

Download and execute an unsigned remote native pager.

AI rationale

Evidence

dist/cli.jsscripts/postinstall-pager.mjsdist/provider-setup.jspackage.jsondist/native/

Network endpoints1

www.clavue.com/downloads/native

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

On Windows launch, the CLI downloads a native executable from the vendor site without a hash or signature check.
The downloaded native file is stored in the user configuration area and selected as the pager executable.
The package is an AI coding CLI with command execution and provider credential handling, increasing the impact of a replaced payload.

Evidence against

The npm postinstall script only changes permissions on packaged pager files and does not download or execute them.
Provider validation sends credentials to the profile URL chosen during explicit provider setup.
No source evidence shows install-time credential harvesting, foreign agent-config mutation, or stealth exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/mao-command.jsView file

Lines 1-24javascript

1import { createRequire as __createRequire } from "node:module";

2const require = __createRequire(import.meta.url);

3// clavue v11.3.15 mao-command (built from source)

5GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$close.call(fs6,fd,function(err){err||resetQueue(),typeof cb=="function"&&cb.apply(this,arguments)})}return __name(close,"close"),Object.defineProperty(close,previousSymbol,{value:fs$close}),close})(fs6.close),fs6.closeSync=(function(fs$closeSync){function closeSync(fd){fs$closeSync.apply(fs6,arguments),resetQueue()}return __name(closeSync,"closeSync"),Object.defineProperty(closeSync,previousSymbol,{value:fs$closeSync}),c ...

6`,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.

7${Date.now()}

8`,null,"utf8")}catch{}try{return fn()}finally{try{fs.closeSync(fd)}catch{}try{fs.unlinkSync(lockPath)}catch{}}}catch(err){if(fd!=null)try{fs.closeSync(fd)}catch{}if((err&&err.code)!=="EEXIST")return fn();let elapsed=Date.now()-start;if(elapsed>=timeoutMs||stole){try{let raw=fs.readFileSync(lockPath,"utf8"),lines=String(raw).split(/\r?\n/),holderPid=Number.parseInt(lines[0]||"",10),lockedAt=Number.parseInt(lines[1]||"",10),holderAlive=!1;if(Number.isFinite(holderPid)&&holderPid>0)try{process4.kill(holderPid,0),holderAlive=!0}catch{holderAlive=!1}let ageMs=Number.isFinite(lockedAt)?Date.now()-lo ...

9`,"utf8")}__name(appendLogLine,"appendLogLine");function appendLogBlock(logFile,title,body){let normalizedBody=String(body??"").trimEnd();normalizedBody&&fs.appendFileSync(logFile,`

10[${nowIso2()}] ${title}

11${normalizedBody}

12`,"utf8")}__name(appendLogBlock,"appendLogBlock");function pidIsRunning(pid){if(!Number.isFinite(pid))return!1;try{return killImpl(pid,0),!0}catch(error){return error?.code==="EPERM"}}__name(pidIsRunning,"pidIsRunning");function sortJobsNewestFirst(jobs){return[...jobs].sort((left,right)=>String(right.updatedAt??"").localeCompare(String(left.updatedAt??"")))}__name(sortJobsNewestFirst,"sortJobsNewestFirst");function readJobProgressPreview(logFile,maxLines=4){return!logFile||!fs.existsSync(logFile)?[]:fs.readFileSync(logFile,"utf8").split(/\r?\n/).map(line=>line.trim()).filter(Boolean).filter(l ...

13`)}__name(buildAdversarialReviewPrompt,"buildAdversarialReviewPrompt");function buildAdversarialReviewCommand({profile,model,context,focusText,schemaFile,resultFile,writeJsonFile:writeJsonFile2}){return writeJsonFile2(schemaFile,REVIEW_SCHEMA

14${result.stdout}`.trim();if(!result.error&&looksLikeMissingProcessMessage(combinedOutput))return{attempted:!0,delivered:!1,method:"taskkill",result};if(result.error?.code==="ENOENT")try{return killImpl(pid),{attempted:!0,delivered:!0,method:"kill"}}catch(error){if(error?.code==="ESRCH")return{attempted:!0,delivered:!1,method:"kill"};throw error}throw result.error?result.error:new Error(formatCommandFailure(result))}try{return killImpl(-pid,"SIGTERM"),{attempted:!0,delivered:!0,method:"process-group"}}catch(error){if(error?.code!=="ESRCH")try{return killImpl(pid,"SIGTERM"),{attempted:!0,deliver ...

15${result.stderr}`),exitCode:result.status});if(result.error)throw result.error;return result.status!==0?{type:"text"

16${formatCommandFailure(result)}

17`}:{type:"text",value:renderJobResult2(completedJob)}}__name(runForegroundJob2,"runForegroundJob");function getStatusJobs2(cwd,limit=8,all=!1){let

18`,"utf8")}finally{try{await release()}catch{}}return filePath}__name(writeMaoCoordinationLedger,"writeMaoCoordinationLedger");async function acquireLedgerLock(filePath){try{await fs3.writeFile(filePath,await readExistingLedgerOrEmpty(filePath),{flag:"a"});let properLockfile=await Promise.resolve().then(()=>__toESM(require_proper_lockfile())),lock=properLockfile.lock??properLockfile.default?.lock;return typeof lock!="function"?async()=>{}:await lock(filePath,{retries:{retries:5,factor:1.5,minTimeout:25,maxTimeout:250},stale:5e3,realpath:!1})}catch{return async()=>{}}}__name(acquireLedgerLock,"a ...

19`,tmp=`${run.runPath}.${process.pid}.${Date.now().toString(36)}.${Math.random().toString(36).slice(2,8)}.tmp`;try{

20`,tmpPath=`${filePath}.${process7.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs5.writeFileSync(tmpPath,payload,"utf8"),fs5.renameSync(tmpPath,filePath)}catch{try{fs5.unlinkSync(tmpPath)}catch{}fs5.writeFileSync(filePath,payload,"utf8")}}__name(writeJsonFile,"writeJsonFile");function safeReadFile(filePath){try{return fs5.readFileSync(filePath,"utf8")}catch{return""}}__name(safeReadFile,"safeReadFile");function normalizeBaseUrl(value){return normalizeProviderBaseUrl(value)}__name(normalizeBaseUrl,"normalizeBaseUrl");function normalizeReasoningEffort(effort){if(effort==n ...

21`).trimEnd()}

22`}let verdict=String(parsed.verdict??"").trim(),summary=String(parsed.summary??"").trim(),findings=Array.isArray(parsed.findings)?parsed.findings.map(normalizeReviewFinding):[],nextSteps=Array.isArray(parsed.next_steps)?parsed.next_steps.filter(step=>typeof step=="string"&&step.trim()).map(step=>step.trim()):[],lines=[`# ${meta.title}`,"",`Target: ${meta.targetLabel}`,`Verdict: ${verdict||"unknown"}`,"",summary||"No summary provided.",""];if(findings.length>0){lines.push("## Findings","");for(let finding of findings.sort((left,right)=>getSeverityRank(left.severity)-getSeverityRank(right.severi ...

23`).trimEnd()}

24`}__name(formatStructuredReviewResult,"formatStructuredReviewResult");function renderJobResult(job){let resultText=safeReadFile(job.resultFile).trim(),logText=safeReadFile(job.logFile);if(job.kind==="adversarial-review")return formatStructuredReviewResult(resultText,{title:"Mao Adversarial Review",targetLabel:job.targetLabel??"repository review"});if(resultText)return resultText.endsWith(`

Long lines were clipped for display.

•matchType = normalized_sha256 matchedPackage = iclavue@11.3.5 matchedPath = dist/mao-command.js matchedIdentity = npm:aWNsYXZ1ZQ:11.3.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mao-command.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0c8307e77f6c9f4b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = iclavue@11.3.5 matchedPath = dist/mao-command.js matchedIdentity = npm:aWNsYXZ1ZQ:11.3.5 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/mao-command.jsView on unpkg

dist/openai-responses-adapter.jsView file

3// clavue v11.3.15 openai-responses-adapter (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: /* [wrapped with `+details+`] */ ... L22: `)+source+`return __p L23: }`;var result2=attempt_default(function(){return Function(importsKeys,sourceURL+"return "+source).apply(void 0,importsValues)});if(result2.source=source,isError_default(result2))th... L24: `):[]}};_LineDecoder_buffer=new WeakMap,_LineDecoder_carriageReturnIndex=new WeakMap;LineDecoder.NEWLINE_CHARS=new Set([` ... L61: new Anthropic({ apiKey, dangerouslyAllowBrowser: true }); L62: `);this.baseURL=options.baseURL,this.timeout=options.timeout??_a.DEFAULT_TIMEOUT,this.lo

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/openai-responses-adapter.jsView on unpkg · L3

75`)===-1){debug3("have not received end of HTTP headers yet..."),read();return}let firstLine=buffered.toString("ascii",0,buffered.indexOf(`\r L76: `)),statusCode=+firstLine.split(" ")[1];debug3("got proxy server response: %o",firstLine),resolve9({statusCode,buffered})}__name(ondata,"ondata"),socket.on("error",onerror),socket.... L77: `;proxy.auth&&(headers["Proxy-Authorization"]=`Basic ${Buffer.from(proxy.auth).toString("base64")}`);let{host,port,secureEndpoint}=opts;isDefaultPort(port,secureEndpoint)||(host+=`... ... L79: `);let{statusCode,buffered}=yield proxyResponsePromise;if(statusCode===200){if(req.once("socket",resume2),opts.secureEndpoint){debug3("Upgrading socket connection to TLS");let serv... L80: `,CRLF_BYTES=textEncoder.encode(CRLF),CRLF_BYTES_COUNT=2,FormDataPart=class{st

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openai-responses-adapter.js

dist/native/clavue-pager-darwin-x64View file

•path = dist/native/clavue-pager-darwin-x64 kind = native_binary sizeBytes = 5348840 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-darwin-x64View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6630 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 17514483 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17514483 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/provider-setup.jsView file

•matchType = normalized_sha256 matchedPackage = iclavue@11.3.5 matchedPath = dist/provider-setup.js matchedIdentity = npm:aWNsYXZ1ZQ:11.3.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-setup.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/mao-command.jsView file

4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos... L6: `,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.writeFileSync(tmpPath,payload,"utf8"),fs.renameSync(tmpPath,filePath)}catc...

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

Findings

1 Critical11 High8 Medium6 Low

CriticalCredential Exfiltrationdist/openai-responses-adapter.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/mao-command.js

HighShell

HighSame File Env Network Executiondist/openai-responses-adapter.js

HighCommand Output Exfiltrationdist/openai-responses-adapter.js

HighCloud Metadata Accessdist/openai-responses-adapter.js

HighSemantic Analysis Limiteddist/openai-responses-adapter.js

HighKnown Malware Source Similaritydist/mao-command.js

HighKnown Malware Source Similaritydist/openai-responses-adapter.js

HighKnown Malware Source Similaritydist/provider-setup.js

Affected versions and remediation

This report applies to iclavue@11.3.15.

See all versions of iclavue for other recorded verdicts.

Review the evidence and your use of iclavue@11.3.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 16:26:18.090Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code