registry / Credential exfiltration / iclavue / 13.9.0

iclavue@13.9.0

Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery

AI Security Review

scanned 1h ago · by lpm-firewall-ai

The source shows a possible credential-routing risk but does not establish an active ordinary-login transfer to the default endpoint. The install hook only changes permissions on bundled pager files, so a warning is appropriate pending resolution of the runtime path.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

CLI startup when provider synchronization checks the current profile, or when a provider validation request uses the constructed profile.

Impact

If this profile is used for a request, an Anthropic key could be disclosed to the Clavue endpoint. The inspected caller does not confirm that transfer.

Mechanism

The profile builder reads ANTHROPIC_API_KEY and falls back to the Clavue cloud URL; validation headers can carry the profile credential.

AI rationale

Evidence

dist/openai-responses-adapter.js

Network endpoints1

api.clavue.com

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The provider profile builder accepts ANTHROPIC_API_KEY and defaults its base URL to api.clavue.com.
The provider validation header builder places the profile credential in bearer and API key headers.
A provider synchronization path checks the current profile and can apply an imported active profile.
The postinstall script only changes permissions on bundled clavue-pager files.

Evidence against

The inspected synchronization caller does not establish that this profile is used for an ordinary request, so credential transfer on the default path remains unresolved.
The flagged adapter is loaded through the CLI entrypoint; environment credential handling also supports the package’s provider configuration features.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

Source & flagged code

20 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/provider-setup.jsView file

1import { execFileSync, spawnSync } from 'node:child_process' L2: import { createHash, randomUUID } from 'node:crypto'

High

Child Process

Package source references child process execution.

dist/provider-setup.jsView on unpkg · L1

dist/openai-responses-adapter.jsView file

3// clavue v13.9.0 openai-responses-adapter (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: `)},"logSink");__name(log,"log");__name(isNativeModuleEnabled2,"isNativeModuleEnabled");__name(candidateRoots,"candidateRoots");__name(libraryName,"libraryName");__name(nativeRsAdd... L6: `),{ok:!0,cleared:!0,speed:null};let next=normalizeDurableExecutionSpeed(raw);return next?(writeJsonAtomic(pathFor(),`${JSON.stringify({speed:next,updatedAt:new Date().toISOString(... L7: `),{ok:!0,speed:next}):{ok:!1}}catch{return{ok:!1}}}var FILE,init_executionSpeedPersist=__esm({"[redacted].ts"(){init_envUtils();FILE="execution-speed.json";... L8:

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/openai-responses-adapter.jsView on unpkg · L3

92`,endIndex)}while(index!==-1);return returnValue+=string4.slice(endIndex),returnValue}var init_utilities=__esm({"../../../rel136/node_modules/chalk/source/utilities.js"(){__name(st... L93: `);return lfIndex!==-1&&(string4=stringEncaseCRLFWithFirstIndex(string4,closeAll,openAll,lfIndex)),openAll+string4+closeAll},"applyStyle");Object.defineProperties(createChalk.proto... L94: `?(templateIndex-=1,rawIndex+=1):nextRawCharacter==="u"&&rawTemplate[rawIndex+2]==="{"?rawIndex=rawTemplate.indexOf("}",rawIndex+3):rawIndex+=ESCAPE_LENGTH[nextRawCharacter]??1}}le...

High

Shell

Package source references shell execution.

dist/openai-responses-adapter.jsView on unpkg · L92

1import { createRequire as __createRequire } from "node:module"; L2: const require = __createRequire(import.meta.url); L3: // clavue v13.9.0 openai-responses-adapter (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: `)},"logSink");__name(log,"log");__name(isNativeModuleEnabled2,"isNativeModuleEnabled");__name(candidateRoots,"candidateRoots");__name(libraryName,"libraryName");__name(nativeRsAdd...

High

Suspicious Native Addon Load

Source dynamically best-effort loads a bundled native addon.

dist/openai-responses-adapter.jsView on unpkg · L1

78`)===-1){debug3("have not received end of HTTP headers yet..."),read();return}let firstLine=buffered.toString("ascii",0,buffered.indexOf(`\r L79: `)),statusCode=+firstLine.split(" ")[1];debug3("got proxy server response: %o",firstLine),resolve9({statusCode,buffered})}__name(ondata,"ondata"),socket.on("error",onerror),socket.... L80: `;proxy.auth&&(headers["Proxy-Authorization"]=`Basic ${Buffer.from(proxy.auth).toString("base64")}`);let{host,port,secureEndpoint}=opts;isDefaultPort(port,secureEndpoint)||(host+=`... ... L82: `);let{statusCode,buffered}=yield proxyResponsePromise;if(statusCode===200){if(req.once("socket",resume2),opts.secureEndpoint){debug3("Upgrading socket connection to TLS");let serv... L83: `,CRLF_BYTES=textEncoder.encode(CRLF),CRLF_BYTES_COUNT=2,FormDataPart=class{st

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openai-responses-adapter.jsView on unpkg · L78

78`)===-1){debug3("have not received end of HTTP headers yet..."),read();return}let firstLine=buffered.toString("ascii",0,buffered.indexOf(`\r L79: `)),statusCode=+firstLine.split(" ")[1];debug3("got proxy server response: %o",firstLine),resolve9({statusCode,buffered})}__name(ondata,"ondata"),socket.on("error",onerror),socket.... L80: `;proxy.auth&&(headers["Proxy-Authorization"]=`Basic ${Buffer.from(proxy.auth).toString("base64")}`);let{host,port,secureEndpoint}=opts;isDefaultPort(port,secureEndpoint)||(host+=`... L81: `;let proxyResponsePromise=parse_proxy_response_1.default(socket);socket.write(`${payload}\r L82: `);let{statusCode,buffered}=yield proxyResponsePromise;if(statusCode===200){if(req.once("socket",resume2),opts.secureEndpoint){debug3("Upgrading socket connection to TLS");l

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/openai-responses-adapter.jsView on unpkg · L78

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/openai-responses-adapter.jsView on unpkg · L3

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/openai-responses-adapter.jsView on unpkg

1import { createRequire as __createRequire } from "node:module"; L2: const require = __createRequire(import.meta.url); L3: // clavue v13.9.0 openai-responses-adapter (built from source)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/openai-responses-adapter.jsView on unpkg · L1

node_modules/ajv/dist/compile/jtd/serialize.jsView file

49sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`; L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode); L51: const serialize = makeSerialize(this.scope.get());

High

Eval

Package source references dynamic code evaluation.

node_modules/ajv/dist/compile/jtd/serialize.jsView on unpkg · L49

dist/native/clavue-pager-darwin-x64View file

•path = dist/native/clavue-pager-darwin-x64 kind = native_binary sizeBytes = 5460752 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-darwin-x64View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6649 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 18069293 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 18069293 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/linux-sandbox-utils.jsView file

•matchType = normalized_sha256 matchedPackage = clavue-v1@1.22.0 matchedPath = node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/linux-sandbox-utils.js matchedIdentity = npm:Y2xhdnVlLXYx:1.22.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High