registry / iclavue / 13.0.1

iclavue@13.0.1

Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic hook is a narrow package-owned binary permission repair, while the flagged network and process features are aligned with an AI coding CLI and bundled sandbox runtime. Static inspection found no self-dependency lifecycle chain or concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Package installation or an explicit CLI command.

Impact

No unconsented data collection, foreign configuration mutation, or destructive action was confirmed.

Mechanism

Package-owned pager permission setup and user-invoked AI CLI execution.

AI rationale

Evidence

dist/native/clavue-pager-*

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest runs a postinstall script automatically.
The bundled adapter defines the package's named Clavue service endpoints.
The Mao command feature can launch a configured Codex command as a background job.
A bundled sandbox-runtime CLI can execute a supplied sandboxed command through a shell.

Evidence against

The postinstall script only sets executable permissions on package-owned pager binaries.
There is no runtime dependency on iclavue itself.
The inspected network configuration is for declared AI-provider functionality, not a hidden collection endpoint.
Command execution is in interactive CLI and sandbox features, not an install hook.
No credential harvesting, secret exfiltration, or foreign agent-control-surface mutation was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/mao-command.jsView file

4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos... L6: `,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.writeFileSync(tmpPath,payload,"utf8"),fs.renameSync(tmpPath,filePath)}catc...

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView file

44.option('-s, --settings <path>', 'path to config file (default: ~/.srt-settings.json)') L45: .option('-c <command>', 'run command string directly (like sh -c), no escaping applied') L46: .option('--control-fd <fd>', 'read config updates from file descriptor (JSON lines protocol)', parseInt)

High

Shell

Package source references shell execution.

node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView on unpkg · L44

node_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.jsView file

7exports.NOOP_METER_PROVIDER = exports.NoopMeterProvider = void 0; L8: const NoopMeter_1 = require("./NoopMeter"); L9: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

node_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.jsView on unpkg · L7

dist/openai-responses-adapter.jsView file

3// clavue v13.0.1 openai-responses-adapter (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: `),{ok:!0,cleared:!0,speed:null};let next=normalizeDurableExecutionSpeed(raw);return next?(writeJsonAtomic(pathFor(),`${JSON.stringify({speed:next,updatedAt:new Date().toISOString(... L6: `),{ok:!0,speed:next}):{ok:!1}}catch{return{ok:!1}}}var FILE,init_executionSpeedPersist=__esm({"[redacted].ts"(){init_envUtils();FILE="execution-speed.json";... L7: /* [wrapped with `+details+`] */ ... L24: `)+source+`return __p L25: }`;var result2=attempt_default(function(){return Function(importsKeys,sourceURL+"return "+source).apply(void 0,importsV

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/openai-responses-adapter.jsView on unpkg · L3

77`)===-1){debug3("have not received end of HTTP headers yet..."),read();return}let firstLine=buffered.toString("ascii",0,buffered.indexOf(`\r L78: `)),statusCode=+firstLine.split(" ")[1];debug3("got proxy server response: %o",firstLine),resolve9({statusCode,buffered})}__name(ondata,"ondata"),socket.on("error",onerror),socket.... L79: `;proxy.auth&&(headers["Proxy-Authorization"]=`Basic ${Buffer.from(proxy.auth).toString("base64")}`);let{host,port,secureEndpoint}=opts;isDefaultPort(port,secureEndpoint)||(host+=`... ... L81: `);let{statusCode,buffered}=yield proxyResponsePromise;if(statusCode===200){if(req.once("socket",resume2),opts.secureEndpoint){debug3("Upgrading socket connection to TLS");let serv... L82: `,CRLF_BYTES=textEncoder.encode(CRLF),CRLF_BYTES_COUNT=2,FormDataPart=class{st

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openai-responses-adapter.js

dist/native/clavue-pager-darwin-x64View file

•path = dist/native/clavue-pager-darwin-x64 kind = native_binary sizeBytes = 5339480 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-darwin-x64View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6629 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 17612916 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17612916 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/mao-command.jsView file

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

node_modules/@anthropic-ai/sandbox-runtime/dist/cli.jsView file

Findings

1 Critical7 High8 Medium6 Low

CriticalCredential Exfiltrationdist/openai-responses-adapter.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/mao-command.js

HighShellnode_modules/@anthropic-ai/sandbox-runtime/dist/cli.js

HighSame File Env Network Executiondist/openai-responses-adapter.js

HighCommand Output Exfiltrationdist/openai-responses-adapter.js

HighCloud Metadata Accessdist/openai-responses-adapter.js

HighSemantic Analysis Limiteddist/openai-responses-adapter.js

MediumDynamic Requirenode_modules/@opentelemetry/api/build/src/metrics/NoopMeterProvider.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to iclavue@13.0.1.

See all versions of iclavue for other recorded verdicts.

Review the evidence and your use of iclavue@13.0.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 21:50:00.330Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.