iclavue@13.6.0
Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected lifecycle and flagged source excerpts support ordinary pager setup, provider authentication, sandbox operation, and schema serialization. Scanner hints alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Package installation triggers the postinstall pager check; provider and sandbox code runs through CLI functionality.
Impact
No confirmed unauthorized credential transfer, destructive action, or broad control-surface mutation was established.
Mechanism
The postinstall script checks for pager binaries and attempts to set their permissions. The inspected provider code prepares credentials for provider authentication, while sandbox proxy code handles proxy transport.
AI rationale
The inspected lifecycle and flagged source excerpts support ordinary pager setup, provider authentication, sandbox operation, and schema serialization. Scanner hints alone do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json runs a postinstall script that checks for the optional pager and sets permissions on pager binaries.
- The provider code places a selected profile credential in provider environment variables; the adapter builds authentication headers from Claude session credentials.
- The bundled sandbox files implement sandbox command handling, platform restrictions, and proxy transport; the Ajv dynamic function generates a serializer.
- The inspected excerpts support the package’s CLI, provider, sandbox, and schema-serialization functions; they do not establish an attack.
Evidence against
- The scanner’s credential-exfiltration label is not supported by the inspected excerpts, which show provider authentication and sandbox proxy handling.
- The install hook excerpt shows pager permission setup and no credential transfer or consumer project policy mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
20 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-pager.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/provider-setup.jsView file
1import { execFileSync, spawnSync } from 'node:child_process'
L2: import { createHash, randomUUID } from 'node:crypto'
High
Child Process
Package source references child process execution.
dist/provider-setup.jsView on unpkg · L1dist/openai-responses-adapter.jsView file
3// clavue v13.6.0 openai-responses-adapter (built from source)
L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO...
L5: `)},"logSink");__name(log,"log");__name(isNativeModuleEnabled2,"isNativeModuleEnabled");__name(candidateRoots,"candidateRoots");__name(libraryName,"libraryName");__name(nativeRsAdd...
L6: `),{ok:!0,cleared:!0,speed:null};let next=normalizeDurableExecutionSpeed(raw);return next?(writeJsonAtomic(pathFor(),`${JSON.stringify({speed:next,updatedAt:new Date().toISOString(...
L7: `),{ok:!0,speed:next}):{ok:!1}}catch{return{ok:!1}}}var FILE,init_executionSpeedPersist=__esm({"[redacted].ts"(){init_envUtils();FILE="execution-speed.json";...
L8:
Findings
1 Critical14 High8 Medium6 Low
CriticalCredential Exfiltrationdist/openai-responses-adapter.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/provider-setup.js
HighShelldist/openai-responses-adapter.js
HighEvalnode_modules/ajv/dist/compile/jtd/serialize.js
HighSuspicious Native Addon Loaddist/openai-responses-adapter.js
HighSame File Env Network Executiondist/openai-responses-adapter.js
HighCommand Output Exfiltrationdist/openai-responses-adapter.js
HighCloud Metadata Accessdist/openai-responses-adapter.js
HighSemantic Analysis Limiteddist/openai-responses-adapter.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to iclavue@13.6.0.
See all versions of iclavue for other recorded verdicts.
- Review the evidence and your use of iclavue@13.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.