registry / mlclaw / 0.12.3

mlclaw@0.12.3

⚠ Under review

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 2.29 MB of source, external domains: 127.0.0.1, api.openai.com, auth.openai.com, evalstate-research-agent-two.hf.space, gist.github.com, github.com, hf.co, huggingface.co, mathiasbynens.be, raw.githubusercontent.com, react.dev, router.huggingface.co, spec.openapis.org, stackoverflow.com, tools.ietf.org, unyolo.io, www.w3.org

Source & flagged code

10 flagged

dist/hf-state-sync.jsView file

4947// src/hf-state-sync/archive.ts L4948: import { execFile } from "node:child_process"; L4949: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/hf-state-sync.jsView on unpkg · L4947

dist/mlclaw.mjsView file

9595// src/mlclaw/hf-cli.ts L9596: import { spawn } from "node:child_process"; L9597: import fs10, { constants as fsConstants } from "node:fs/promises"; ... L9599: import path11 from "node:path"; L9600: var HF_CLI_INSTALL_URL = "https://hf.co/cli/install.sh"; L9601: var HF_ACCOUNT_CREATE_URL = "https://huggingface.co/join"; L9602: var HF_CLI_INSTALL_COMMAND = `curl -LsSf ${HF_CLI_INSTALL_URL} | bash`; L9603: function createSystemHfCli(env = process.env) { L9604: return {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/mlclaw.mjsView on unpkg · L9595

•Trigger-reachable chain: manifest.bin -> dist/mlclaw.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/mlclaw.mjsView on unpkg

2056} L2057: const execArgv = process5.execArgv ?? []; L2058: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/mlclaw.mjsView on unpkg · L2056

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mlclaw.mjs: import * as b from "node:readline"; import E from "node:readline"; await fs6.writeFile(absPath, Buffer.concat(chunks)); repo: (cwd) => path7.join(resolveRepoRoot(cwd), ".codex/skills"), cwd: (cwd) => path7.join(cwd, ".codex/skills"), const root = process.env.CODEX_HOME ?? path7.join(os.homedir(), ".codex"); repo: (cwd) => path7.join(resolveRepoRoot(cwd), ".claude/skills"), user: () => path7.join(os.homedir(), ".claude/skills")

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mlclaw.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/mlclaw.mjs: // node_modules/commander/lib/error.js "node_modules/commander/lib/error.js"(exports) { // node_modules/commander/lib/argument.js "node_modules/commander/lib/argument.js"(exports) { // node_modules/commander/lib/help.js "node_modules/commander/lib/help.js"(exports) { * Detect manually wrapped and indented strings by checking for line break followed by whitespace. * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/mlclaw.mjsView on unpkg

47Cross-file remote execution chain: dist/mlclaw.mjs spawns dist/hf-state-sync.js; helper contains network access plus dynamic code execution. L47: * Constructs the CommanderError class L48: * @param {number} exitCode suggested exit code which could be used with process.exit L49: * @param {string} code an id string representing the error ... L1203: var EventEmitter = __require("node:events").EventEmitter; L1204: var childProcess = __require("node:child_process"); L1205: var path16 = __require("node:path"); ... L1253: this._outputConfiguration = { L1254: writeOut: (str) => process5.stdout.write(str), L1255: writeErr: (str) => process5.stderr.write(str), ... L1295: * @returns {Command[]} L1296: * @private L1297: */

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/mlclaw.mjsView on unpkg · L47

47Detached bundled service listener: dist/mlclaw.mjs spawns dist/mlclaw-space-runtime.js; helper exposes a broad-bound HTTP listener. L47: * Constructs the CommanderError class L48: * @param {number} exitCode suggested exit code which could be used with process.exit L49: * @param {string} code an id string representing the error ... L1203: var EventEmitter = __require("node:events").EventEmitter; L1204: var childProcess = __require("node:child_process"); L1205: var path16 = __require("node:path"); ... L1253: this._outputConfiguration = { L1254: writeOut: (str) => process5.stdout.write(str), L1255: writeErr: (str) => process5.stderr.write(str), ... L1295: * @returns {Command[]} L1296: * @private L1297: */

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/mlclaw.mjsView on unpkg · L47

mlclaw.shView file

•path = mlclaw.sh kind = build_helper sizeBytes = 3428 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mlclaw.shView on unpkg

entrypoint.shView file

•matchType = previous_version_dangerous_delta matchedPackage = mlclaw@0.12.1 matchedIdentity = npm:bWxjbGF3:0.12.1 similarity = 0.979 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

entrypoint.shView on unpkg

Source & flagged code

10 flagged · loading source

mlclaw@0.12.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code