registry / AI-agent control-surface risk / sealclaw
sealclaw
Multi-channel AI gateway with extensible messaging integrations
This report shows the evidence for sealclaw@2026.9.3. 3 of 26 known versions are blocked or flagged. The newest version, 2026.10.12, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic postinstall hook rewrites a foreign AI runtime in the consumer dependency tree. This is a concrete install-hook abuse even though the inspected code does not exfiltrate data.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation runs the postinstall lifecycle hook.
Impact
It alters the behavior of the pi-ai runtime used by the consumer installation.
Mechanism
Automatic foreign dependency source rewrite.
Policy narrative
On installation, the package invokes a postinstall script that walks ancestor directories to find pi-ai outside its own package directory. It replaces matched code and writes the modified provider runtime back to disk. This is an unconsented lifecycle-time mutation of a foreign AI-agent dependency.
AI rationale
The automatic postinstall hook rewrites a foreign AI runtime in the consumer dependency tree. This is a concrete install-hook abuse even though the inspected code does not exfiltrate data.
Evidence
package.jsonscripts/postinstall-patch-pi-ai.mjsnode_modules/@mariozechner/pi-ai/dist/providers/openai-completions.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-responses-shared.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest automatically runs a postinstall script.
- That script searches parent directories for a separately installed AI runtime file.
- The postinstall rewrites the foreign pi-ai runtime without user action.
Evidence against
- The preinstall hook only detects the package manager and prints a warning.
- The inspected patch contains no network request or credential collection.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/proxy-cli.runtime-BWHciWzX.jsView file
764patternName = generic_password
severity = medium
line = 764
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/proxy-cli.runtime-BWHciWzX.jsView on unpkg · L764Findings
1 Critical6 High8 Medium6 Low
CriticalTrojan Source Unicodedist/control-ui/assets/index-CKP5GwLX.js
HighInstall Time Lifecycle Scriptspackage.json
HighCloud Metadata Accessdist/control-ui/assets/index-CKP5GwLX.js
HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py
HighSemantic Analysis Limiteddist/approval-native-runtime-B7-Q8YuY.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js
HighPrevious Version Dangerous Deltascripts/preinstall-package-manager-warning.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patterndist/proxy-cli.runtime-BWHciWzX.js
MediumDynamic Requiredist/status.gather-C91Qzjwd.js
Affected versions and remediation
This report applies to sealclaw@2026.9.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing sealclaw@2026.9.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.