registry / Install hook abuse / sealclaw / 2026.10.9

sealclaw@2026.10.9

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The source confirms an automatic postinstall mutation of a dependency, so a warning is appropriate. The inspected patch is narrow and guarded, and the evidence does not establish malicious behavior warranting a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs its postinstall hook.

Impact

The installed dependency's provider code is changed to pass through a cost value; no credential theft or broader attack was established.

Mechanism

The hook finds specified pi-ai provider files, checks for an expected code anchor, and writes a patched version when the anchor exists.

AI rationale

Evidence

package.jsonscripts/postinstall-patch-pi-ai.mjsnode_modules/@mariozechner/pi-ai/dist/providers/openai-completions.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-responses-shared.js

Decision evidence

public snapshot

AI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs a postinstall script that patches an installed dependency.
The patch targets specific pi-ai provider files and adds passthrough handling for a cost value.
The script writes the modified dependency file when its expected anchor is present.
The audit target lists installed plugin directories; the CLI target creates AGENTS.md as part of wiki vault initialization.

Evidence against

The dependency patch is narrowly anchored, skips when the target or expected code is absent, and is idempotent.
The inspected agent-related code shows plugin enumeration and wiki vault initialization, not an install-time agent control-surface mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

11 flagged

package.jsonView file

Lines 1312-1353json

1312 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1313 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1314 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1315 "openclaw": "node scripts/run-node.mjs",

1316 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1317 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1318 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1319 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1320 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1321 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1322 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1323 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1324 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1325 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1326 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1327 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1328 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1329 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1330 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1331 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1332 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1332

1333 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1333

1334 "prepack": "node --import tsx scripts/openclaw-prepack.ts",

1335 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1336 "prepush:ci": "bash scripts/prepush-ci.sh",

1337 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1338 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1339 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1340 "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",

1341 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1342 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1343 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1344 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1345 "proxy:run": "node scripts/run-node.mjs proxy run",

1346 "proxy:start": "node scripts/run-node.mjs proxy start",

1347 "release:beta-smoke": "node --import tsx scripts/release-beta-smoke.ts",

1348 "release:check": "pnpm deps:root-ownership:check && pnpm plugins:inventory:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

1349 "release:openclaw:npm:check": "node --import tsx scripts/openclaw-npm-release-check.ts",

1350 "release:openclaw:npm:verify-published": "node --import tsx scripts/openclaw-npm-postpublish-verify.ts",

1351 "release:plugins:npm:check": "node --import tsx scripts/plugin-npm-release-check.ts",

1352 "release:plugins:npm:plan": "node --import tsx scripts/plugin-npm-release-plan.ts",

1353 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

dist/channel-entry-contract-D5iL7RmB.jsView file

Lines 1-31javascript

1import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-Bje8XVt9.js";

2import { i as openRootFileSync } from "./boundary-file-read-DDmXSOFm.js";

3import { r as getCachedPluginSourceModuleLoader, s as toSafeImportPath } from

dist/cli-D6hhYBSL.jsView file

Lines 2-42javascript

2import { f as FsSafeError } from "./path-DSyl_wQR.js";

3import { a as root } from "./filename-B77PYM5d.js";

4import { h as pathExists } from "./fs-safe-BzPvEfh_.js";

dist/control-ui/assets/index-C-Pe6n3D.jsView file

6900contains invisible/control Unicode U+200C (zero width non-joiner) `}var g6=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-C-Pe6n3D.jsView on unpkg · L6900

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/docx-preview-DMEG690f.js","assets/chunk-62oNxeRG.js","assets/jszip.min-C9xvYp-s.js","assets/pptx-preview.es-eMvLaQp... L2: import{i as e,n as t,t as n}from"./chunk-62oNxeRG.js";import{a as r,c as i,i as a,l as o,n as s,o as c,r as l,s as u,t as d,u as f}from"./lit-BpL4H2cG.js";import{t as p}from"./requ... L3: `+re+e}var F=!1;function L(e,t){if(!e||F)return``;F=!0;var n=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(t)if(t=function(){throw Error()},Object.defineProperty(t.... ... L5: `),o=i.length-1,s=a.length-1;1<=o&&0<=s&&i[o]!==a[s];)s--;for(;1<=o&&0<=s;o--,s--)if(i[o]!==a[s]){if(o!==1||s!==1)do if(o--,s--,0>s||i[o]!==a[s]){var c=` L6: `+i[o].replace(` at new `,` at `);return e.displayName&&c.includes(`<a

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/control-ui/assets/index-C-Pe6n3D.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

scripts/preinstall-package-manager-warning.mjsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = scripts/preinstall-package-manager-warning.mjs matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/preinstall-package-manager-warning.mjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/channel-entry-contract-D5iL7RmB.jsView file

11//#region src/plugin-sdk/channel-entry-contract.ts L12: const nodeRequire = createRequire(import.meta.url); L13: const moduleLoaders = /* @__PURE__ */ new Map();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channel-entry-contract-D5iL7RmB.js

Findings

1 Critical6 High6 Medium8 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-C-Pe6n3D.js

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessdist/control-ui/assets/index-C-Pe6n3D.js

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-C-Pe6n3D.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Similarityscripts/preinstall-package-manager-warning.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/channel-entry-contract-D5iL7RmB.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to sealclaw@2026.10.9.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.10.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 14:24:36.982Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.