registry / openclaw-channel-gateway / 1.1.1

openclaw-channel-gateway@1.1.1

OpenClaw IM channel gateway — bridge Telegram/Discord/WeChat/DingTalk/QQ to any OpenAI-compatible agent API

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 156 KB of source, external domains: 127.0.0.1, oapi.dingtalk.com

Source & flagged code

3 flagged

bin/ocg.cjsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * Lite Gateway CLI bootstrap (CommonJS, cross-platform).

5 *

6 * npm's bin shim invokes this script. It spawns `node --import <loader> <cli>`

7 * so the ESM loader hook activates before any module graph is built.

8 */

10"use strict";

12const { spawn } = require("child_process");

13const path = require("path");

High

Child Process

Package source references child process execution.

bin/ocg.cjsView on unpkg · L11

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ocg.cjsView on unpkg · L11

14const { pathToFileURL } = require("url");

16const root = path.resolve(__dirname, "..");

17const loader = pathToFileURL(path.join(root, "dist", "loader.js")).href;

18const cli = path.join(root, "dist", "cli.js");

20const args = ["--import", loader, cli, ...process.argv.slice(2)];

22const child = spawn(process.execPath, args, {

23 stdio: "inherit",

24 cwd: process.cwd(),

25});

27child.on("exit", (code) => {

28 process.exit(code ?? 1);

29});

31child.on("error", (err) => {

dist/cli.jsView file

Lines 600-640javascript

600 process.exit(1);

601 }

602}

603function resolveUpgradeTarget(args) {

604 if (typeof args["target"] === "string")

605 return args["target"];

Source & flagged code

3 flagged · loading source

bin/ocg.cjsView file

11L12: const { spawn } = require("child_process"); L13: const path = require("path");

High

Child Process

Package source references child process execution.

bin/ocg.cjsView on unpkg · L11

11L12: const { spawn } = require("child_process"); L13: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ocg.cjsView on unpkg · L11

dist/cli.jsView file

620try { L621: execSync(`npm install ${pkg}`, { cwd, stdio: "inherit" }); L622: console.log(`[ocg] ${pkg} installed.`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L620

Findings

3 High4 Medium4 Low

HighChild Processbin/ocg.cjs

HighShell

HighRuntime Package Installdist/cli.js

MediumDynamic Requirebin/ocg.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

3 flagged

bin/ocg.cjsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * Lite Gateway CLI bootstrap (CommonJS, cross-platform).

5 *

6 * npm's bin shim invokes this script. It spawns `node --import <loader> <cli>`

7 * so the ESM loader hook activates before any module graph is built.

8 */

10"use strict";

12const { spawn } = require("child_process");

13const path = require("path");

High

Child Process

Package source references child process execution.

bin/ocg.cjsView on unpkg · L11

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ocg.cjsView on unpkg · L11

14const { pathToFileURL } = require("url");

16const root = path.resolve(__dirname, "..");

17const loader = pathToFileURL(path.join(root, "dist", "loader.js")).href;

18const cli = path.join(root, "dist", "cli.js");

20const args = ["--import", loader, cli, ...process.argv.slice(2)];

22const child = spawn(process.execPath, args, {

23 stdio: "inherit",

24 cwd: process.cwd(),

25});

27child.on("exit", (code) => {

28 process.exit(code ?? 1);

29});

31child.on("error", (err) => {

dist/cli.jsView file

Lines 600-640javascript

600 process.exit(1);

601 }

602}

603function resolveUpgradeTarget(args) {

604 if (typeof args["target"] === "string")

605 return args["target"];