iclavue@12.0.14
Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe postinstall hook is limited to chmod on package-native files, so the evidence does not establish malicious install-hook abuse. The explicit runtime capabilities to rewrite compatible external configuration and fetch a native executable remain unresolved security risk.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Saving or activating a provider profile, or launching the interactive CLI when its pager is absent.
Impact
A provider selection can change another tool's active profile, and a remote executable can be fetched and run in the user's Clavue environment.
Mechanism
External configuration mutation and remote native-binary retrieval.
AI rationale
The postinstall hook is limited to chmod on package-native files, so the evidence does not establish malicious install-hook abuse. The explicit runtime capabilities to rewrite compatible external configuration and fetch a native executable remain unresolved security risk.
Evidence
dist/provider-setup.jsdist/cli.js~/.ccjk/config.toml~/.ufomiao/zcf/config.toml~/.clavue/native
Network endpoints1
www.clavue.com/downloads/native
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Provider setup explicitly targets existing ccjk and zcf configuration files outside the package.
- Saving a provider profile updates compatible external configuration after persisting Clavue state.
- The bundled CLI can download a native pager executable from the Clavue site during interactive use; no integrity verification is visible in that loader.
Evidence against
- The install hook only makes bundled pager files executable and does not modify user configuration.
- There is no runtime dependency on iclavue or other self-installing lifecycle chain.
- Provider configuration changes are reached through profile save or activation functions, not the install hook.
- The inspected adapter routes configured API requests and does not show credential exfiltration to an unrelated endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-pager.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/mao-command.jsView file
4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos...
L6: `,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.writeFileSync(tmpPath,payload,"utf8"),fs.renameSync(tmpPath,filePath)}catc...
High
Child Process
Package source references child process execution.
dist/mao-command.jsView on unpkg · L4node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView file
Findings
1 Critical7 High8 Medium6 Low
CriticalCredential Exfiltrationdist/openai-responses-adapter.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/mao-command.js
HighShellnode_modules/@anthropic-ai/sandbox-runtime/dist/cli.js
HighSame File Env Network Executiondist/openai-responses-adapter.js
HighCommand Output Exfiltrationdist/openai-responses-adapter.js
HighCloud Metadata Accessdist/openai-responses-adapter.js
HighSemantic Analysis Limiteddist/openai-responses-adapter.js
MediumDynamic Requirenode_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to iclavue@12.0.14.
See all versions of iclavue for other recorded verdicts.
- Review the evidence and your use of iclavue@12.0.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.