registry / mlclaw / 0.10.2

mlclaw@0.10.2

⚠ Under review

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 2.24 MB of source, external domains: 127.0.0.1, api.openai.com, auth.openai.com, evalstate-research-agent-two.hf.space, gist.github.com, github.com, hf.co, huggingface.co, mathiasbynens.be, raw.githubusercontent.com, react.dev, router.huggingface.co, spec.openapis.org, stackoverflow.com, tools.ietf.org, unyolo.io, www.w3.org

Source & flagged code

8 flagged

dist/hf-state-sync.jsView file

Lines 4926-4966javascript

4926}

4927function remotePath(config, name) {

4928 return `${normalizeBucketPrefix(config.bucketPrefix)}/${name.replace(/^\/+/, "")}`;

4929}

4930function normalizeBucketPrefix(prefix) {

4931 const normalized = (prefix?.trim() || DEFAULT_BUCKET_PREFIX).replace(/^\/+|\/+$/g, "");

4932 return normalized || DEFAULT_BUCKET_PREFIX;

4933}

4934function log(message) {

4935 console.log(`[hf-state-sync] ${message}`);

4936}

4937function logError(message) {

4938 console.error(`[hf-state-sync] ${message}`);

4939}

4940

4941// src/hf-state-sync/restore.ts

4942import fs4 from "node:fs/promises";

4943import os from "node:os";

4944import path4 from "node:path";

4945

4946// src/hf-state-sync/archive.ts

4947import { execFile } from "node:child_process";

4948import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/hf-state-sync.jsView on unpkg · L4946

4949import { createReadStream } from "node:fs";

4950import fs3 from "node:fs/promises";

4951import path3 from "node:path";

4952import { pipeline } from "node:stream/promises";

4953import { promisify } from "node:util";

4954

4955// src/hf-state-sync/sqlite.ts

4956import fs2 from "node:fs/promises";

4957import path2 from "node:path";

4958import { DatabaseSync } from "node:sqlite";

4959async function findSqliteFiles(root) {

4960 const found = [];

4961 let entries;

4962 try {

4963 entries = await fs2.readdir(root, { withFileTypes: true, recursive: true });

4964 } catch {

4965 return found;

4966 }

dist/mlclaw.mjsView file

9595// src/mlclaw/hf-cli.ts L9596: import { spawn } from "node:child_process"; L9597: import fs10, { constants as fsConstants } from "node:fs/promises"; ... L9599: import path11 from "node:path"; L9600: var HF_CLI_INSTALL_URL = "https://hf.co/cli/install.sh"; L9601: var HF_ACCOUNT_CREATE_URL = "https://huggingface.co/join"; L9602: var HF_CLI_INSTALL_COMMAND = `curl -LsSf ${HF_CLI_INSTALL_URL} | bash`; L9603: function createSystemHfCli(env = process.env) { L9604: return {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/mlclaw.mjsView on unpkg · L9595

•Trigger-reachable chain: manifest.bin -> dist/mlclaw.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/mlclaw.mjsView on unpkg

2056} L2057: const execArgv = process5.execArgv ?? []; L2058: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/mlclaw.mjsView on unpkg · L2056

mlclaw.shView file

•path = mlclaw.sh kind = build_helper sizeBytes = 3428 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlclaw.shView on unpkg

dist/mlclaw-space-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mlclaw@0.8.0 matchedIdentity = npm:bWxjbGF3:0.8.0 similarity = 0.895 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mlclaw-space-runtime.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/hf-state-sync.jsView file

4946// src/hf-state-sync/archive.ts L4947: import { execFile } from "node:child_process"; L4948: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/hf-state-sync.jsView on unpkg · L4946

dist/mlclaw.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/mlclaw.mjsView on unpkg · L9595

•Trigger-reachable chain: manifest.bin -> dist/mlclaw.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/mlclaw.mjsView on unpkg

2056} L2057: const execArgv = process5.execArgv ?? []; L2058: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/mlclaw.mjsView on unpkg · L2056

47Cross-file remote execution chain: dist/mlclaw.mjs spawns dist/hf-state-sync.js; helper contains network access plus dynamic code execution. L47: * Constructs the CommanderError class L48: * @param {number} exitCode suggested exit code which could be used with process.exit L49: * @param {string} code an id string representing the error ... L1203: var EventEmitter = __require("node:events").EventEmitter; L1204: var childProcess = __require("node:child_process"); L1205: var path16 = __require("node:path"); ... L1253: this._outputConfiguration = { L1254: writeOut: (str) => process5.stdout.write(str), L1255: writeErr: (str) => process5.stderr.write(str), ... L1295: * @returns {Command[]} L1296: * @private L1297: */

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/mlclaw.mjsView on unpkg · L47

47Detached bundled service listener: dist/mlclaw.mjs spawns dist/mlclaw-space-runtime.js; helper exposes a broad-bound HTTP listener. L47: * Constructs the CommanderError class L48: * @param {number} exitCode suggested exit code which could be used with process.exit L49: * @param {string} code an id string representing the error ... L1203: var EventEmitter = __require("node:events").EventEmitter; L1204: var childProcess = __require("node:child_process"); L1205: var path16 = __require("node:path"); ... L1253: this._outputConfiguration = { L1254: writeOut: (str) => process5.stdout.write(str), L1255: writeErr: (str) => process5.stderr.write(str), ... L1295: * @returns {Command[]} L1296: * @private L1297: */

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/mlclaw.mjsView on unpkg · L47

mlclaw.shView file

•path = mlclaw.sh kind = build_helper sizeBytes = 3428 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlclaw.shView on unpkg

dist/mlclaw-space-runtime.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mlclaw-space-runtime.jsView on unpkg

Findings

3 Critical4 High5 Medium4 Low

CriticalSame File Env Network Executiondist/mlclaw.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/mlclaw.mjs

CriticalPrevious Version Dangerous Deltadist/mlclaw-space-runtime.js

HighChild Processdist/hf-state-sync.js

HighShelldist/mlclaw.mjs

HighCross File Remote Execution Contextdist/mlclaw.mjs

HighSpawned Bundled Service Listenerdist/mlclaw.mjs

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpermlclaw.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mlclaw@0.10.2.

See version security history for other recorded verdicts.

Review the evidence and your use of mlclaw@0.10.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-10 18:55:45.913Z (UTC).