scaffold-agent@0.1.31: Suspicious npm security report (Warn)

Loading npm security reports…

scaffold-agent@0.1.31: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/cli.js` conditionally writes `.cursor/mcp.json` and `.mcp.json` with MCP commands.
Generated MCP config invokes `npx -y @1claw/mcp@0.40.3` and `@graphprotocol/subgraph-mcp@latest`.
`dist/cli.js` can POST user-supplied keys to `https://api.1claw.xyz` to create vaults and store secrets.
The user-invoked CLI runs `npm install` in the newly scaffolded project and may run its generated funding script.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` hook; only `prepublishOnly`.
MCP configuration is guarded by selected 1Claw/graph integration and is written into the new project, not a broad existing agent surface.
Vault uploads use values supplied through wizard options or explicit secret-helper input; no ambient credential harvesting was found.
No remote code download/eval, stealth persistence, destructive action, or unrelated network endpoint was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 383 KB of source, external domains: 127.0.0.1, 1claw.xyz, ai.google.dev, ampersend.ai, api-sepolia.basescan.org, api.1claw.xyz, api.ampersend.ai, api.basescan.org, api.bscscan.com, api.studio.thegraph.com, api.thegraph.com, app.ens.domains, basescan.org, book.getfoundry.sh, bsc-dataseed.binance.org, bscscan.com, buidlguidl.com, cloud.google.com, cloud.walletconnect.com, docs.1claw.xyz, docs.ampersend.ai, docs.ens.domains, eth.llamarpc.com, ethereum.publicnode.com, etherscan.io, faucet.coinbin.org, faucet.preprod.world.dev.cardano.org, faucet.solana.com, fonts.googleapis.com, fonts.gstatic.com, foundry.paradigm.xyz, gateway.thegraph.com, github.com, hardhat.org, httpay.xyz, just.systems, mainnet.base.org, nodejs.org, polygon-rpc.com, polygonscan.com, rpc.sepolia.org, scaffoldeth.io, sdk.ag0.xyz, sepolia.base.org, sepolia.basescan.org, sepolia.etherscan.io, shasta.tronex.io, shroud.1claw.xyz, thegraph.com, ui.shadcn.com

Source & flagged code

8 flagged

dist/cli.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3// src/cli.ts

4import { join as join4, dirname as dirname2, resolve as resolve2 } from "path";

5import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";

6import { fileURLToPath as fileURLToPath2 } from "url";

7import { spawn } from "child_process";

8import chalk3 from "chalk";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L6

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L6

9import ora from "ora";

11// src/cli-argv.ts

12import { parseArgs } from "util";

13var SECRETS = ["oneclaw", "encrypted", "none"];

14var LLM = ["oneclaw", "gemini", "openai", "anthropic"];

15var SHROUD_UPSTREAM = [

16 "openai",

17 "anthropic",

18 "google",

19 "gemini",

20 "mistral",

21 "cohere",

22 "openrouter",

23 "darkbloom",

24 "venice"

25];

26var SHROUD_BILLING = [

Lines 1998-2038javascript

1998]);

1999

2000const gen = spawnSync(process.execPath, ["scripts/generate-abi-types.mjs"], {

2001 cwd: root,

2002 stdio: "inherit",

2003 env: process.env,

2004});

2005if (gen.status !==

Lines 2376-2416javascript

2376function getGenerateDeployerScript() {

2377 return `#!/usr/bin/env node

2378import { readFileSync, writeFileSync, existsSync } from "fs";

2379import { join } from "path";

2380import {

2381 decryptSecretsFile,

2382 loadPublicEnvFile,

2383 promptSecretsPassword,

2384 saveSecretsFile,

2385 upsertEnvLine,

Lines 3424-3464javascript

3424 const bytes = randomBytes(len);

3425 let out = "";

3426 for (let i = 0; i < len; i++) out +=

Lines 10931-10971javascript

10931 const exitCode = await new Promise((resolve3) => {

10932 const child = spawn("npm", ["install"], {

•matchType = previous_version_dangerous_delta matchedPackage = scaffold-agent@0.1.28 matchedIdentity = npm:c2NhZmZvbGQtYWdlbnQ:0.1.28 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/cli.jsView file

6import { fileURLToPath as fileURLToPath2 } from "url"; L7: import { spawn } from "child_process"; L8: import chalk3 from "chalk"; ... L252: import { isAddress } from "viem"; L253: import { generatePrivateKey, privateKeyToAccount } from "viem/accounts"; L254: function isValidEthAddress(val) { ... L504: const sessionKeyPrivateKey = await password({ L505: message: "Session key private key (0x..., for AGENT_PRIVATE_KEY):", L506: mask: "*", ... L784: try { L785: raw = JSON.parse(readFileSync(abs, "utf8")); L786: } catch (e) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L6

6Trigger-reachable chain: manifest.bin -> dist/cli.js L6: import { fileURLToPath as fileURLToPath2 } from "url"; L7: import { spawn } from "child_process"; L8: import chalk3 from "chalk"; ... L252: import { isAddress } from "viem"; L253: import { generatePrivateKey, privateKeyToAccount } from "viem/accounts"; L254: function isValidEthAddress(val) { ... L504: const sessionKeyPrivateKey = await password({ L505: message: "Session key private key (0x..., for AGENT_PRIVATE_KEY):", L506: mask: "*", ... L784: try { L785: raw = JSON.parse(readFileSync(abs, "utf8")); L786: } catch (e) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L6

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

6import { fileURLToPath as fileURLToPath2 } from "url"; L7: import { spawn } from "child_process"; L8: import chalk3 from "chalk";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L6

3444stdio: "pipe", L3445: shell: true, L3446: timeout: 30_000,

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L3444

10951} L10952: if (chain !== "none" && process.env.SCAFFOLD_SKIP_AUTO_FUND !== "1" && !w.skipAutoFund) { L10953: const fundScript = join4(projectDir, "scripts", "fund-deployer.mjs"); ... L10955: await new Promise((resolve3) => { L10956: const child = spawn(process.execPath, ["scripts/fund-deployer.mjs"], { L10957: cwd: projectDir, ... L10963: info( L10964: "Auto-fund only works if a node is already running on your RPC (default http://127.0.0.1:8545). Start just chain first, then: cd " + projectName + " && just fund \u2192 just deploy... L10965: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L10951

2018L2019: let r = spawnSync("npx", ["hardhat", "deploy", "--network", network], { L2020: cwd: hh,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L2018

2396try { L2397: const { fundLocalAddresses } = await import("./fund-deployer.mjs"); L2398: const pub = loadPublicEnvFile(ENV_PATH);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L2396

Source & flagged code

8 flagged

dist/cli.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3// src/cli.ts

4import { join as join4, dirname as dirname2, resolve as resolve2 } from "path";

5import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";

6import { fileURLToPath as fileURLToPath2 } from "url";

7import { spawn } from "child_process";

8import chalk3 from "chalk";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L6

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L6

9import ora from "ora";

11// src/cli-argv.ts

12import { parseArgs } from "util";

13var SECRETS = ["oneclaw", "encrypted", "none"];

14var LLM = ["oneclaw", "gemini", "openai", "anthropic"];

15var SHROUD_UPSTREAM = [

16 "openai",

17 "anthropic",

18 "google",

19 "gemini",

20 "mistral",

21 "cohere",

22 "openrouter",

23 "darkbloom",

24 "venice"

25];

26var SHROUD_BILLING = [

Lines 1998-2038javascript

1998]);

1999

2000const gen = spawnSync(process.execPath, ["scripts/generate-abi-types.mjs"], {

2001 cwd: root,

2002 stdio: "inherit",

2003 env: process.env,

2004});

2005if (gen.status !==

Lines 2376-2416javascript

2376function getGenerateDeployerScript() {

2377 return `#!/usr/bin/env node

2378import { readFileSync, writeFileSync, existsSync } from "fs";

2379import { join } from "path";

2380import {

2381 decryptSecretsFile,

2382 loadPublicEnvFile,

2383 promptSecretsPassword,

2384 saveSecretsFile,

2385 upsertEnvLine,

Lines 3424-3464javascript

3424 const bytes = randomBytes(len);

3425 let out = "";

3426 for (let i = 0; i < len; i++) out +=

Lines 10931-10971javascript

10931 const exitCode = await new Promise((resolve3) => {

10932 const child = spawn("npm", ["install"], {

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

scaffold-agent@0.1.31

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code