iclavue@11.3.21
Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a user-invoked remote native-code execution path without integrity verification. Its postinstall hook is limited to chmod on bundled files, so the evidence does not establish install-time malware.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
User starts a CLI path that needs the native pager, especially on Windows.
Impact
A substituted download can result in arbitrary code execution as the CLI user.
Mechanism
Downloads, chmods, and spawns a native pager executable.
AI rationale
The package has a user-invoked remote native-code execution path without integrity verification. Its postinstall hook is limited to chmod on bundled files, so the evidence does not establish install-time malware.
Evidence
dist/cli.jsscripts/postinstall-pager.mjsdist/native/manifest.json$HOME/.clavue/nativedist/native
Network endpoints1
www.clavue.com/downloads/native
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Interactive CLI code downloads a native executable from an environment-overridable URL without verifying a hash or signature.
- The downloaded executable is saved, made executable, resolved as the pager binary, and launched as a child process.
Evidence against
- The npm postinstall hook only changes permissions on bundled pager files and does not download or launch them.
- The default download host is package-aligned, but the missing integrity verification leaves a real runtime payload-replacement risk.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-pager.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/mao-command.jsView file
4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos...
L6: `,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.writeFileSync(tmpPath,payload,"utf8"),fs.renameSync(tmpPath,filePath)}catc...
High
Child Process
Package source references child process execution.
dist/mao-command.jsView on unpkg · L4•matchType = normalized_sha256
matchedPackage = iclavue@11.3.5
matchedPath = dist/mao-command.js
matchedIdentity = npm:aWNsYXZ1ZQ:11.3.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
1 Critical11 High8 Medium6 Low
CriticalCredential Exfiltrationdist/openai-responses-adapter.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/mao-command.js
HighShell
HighSame File Env Network Executiondist/openai-responses-adapter.js
HighCommand Output Exfiltrationdist/openai-responses-adapter.js
HighCloud Metadata Accessdist/openai-responses-adapter.js
HighSemantic Analysis Limiteddist/openai-responses-adapter.js
HighKnown Malware Source Similaritydist/mao-command.js
HighKnown Malware Source Similaritydist/openai-responses-adapter.js
HighKnown Malware Source Similaritydist/provider-setup.js
Affected versions and remediation
This report applies to iclavue@11.3.21.
See all versions of iclavue for other recorded verdicts.
- Review the evidence and your use of iclavue@11.3.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.