sealclaw@2026.8.20
Multi-channel AI gateway with extensible messaging integrations
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe automatic postinstall rewrite of a foreign dependency is an unresolved install-time mutation, so I classify this as suspicious. Inspected code limits the patch to provider cost reporting and does not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package with npm or another package manager that runs its postinstall hook.
Impact
This changes behavior of a foreign dependency without an explicit command; inspected code limits the change to usage-cost reporting and shows no payload execution or data transfer.
Mechanism
The script searches ancestor node_modules directories, matches known source anchors, and writes modified provider source files.
AI rationale
The automatic postinstall rewrite of a foreign dependency is an unresolved install-time mutation, so I classify this as suspicious. Inspected code limits the patch to provider cost reporting and does not establish a concrete attack.
Evidence
scripts/postinstall-patch-pi-ai.mjs
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that locates and rewrites files in the installed @mariozechner/pi-ai dependency.
- The rewrite is narrowly anchored to provider usage-cost handling and changes the reported total cost.
- The preinstall hook only detects the package manager and prints a warning.
- The flagged audit and CLI locations enumerate installed plugins and initialize a memory wiki when invoked; they do not show install-time agent control changes.
- The bidi control appears in a bundled asset's embedded font data; the inspected excerpt does not show executable behavior tied to it.
Evidence against
- The postinstall patch modifies a foreign dependency automatically during installation, without an explicit user command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/control-ui/assets/pdf.worker-Cs7OcXTM.jsView file
1import{Z as e,p as t}from"./index-BOHJE7UE.js";import{a as n,i as r,n as i,r as a,t as o}from"./classPrivateFieldSet2-DSsIYuru.js";var s,c,l,u,d,f,p,m,h,g,_,v,y,b,x,S,C,w,T={};T.d=...
L2: `?`\\n`:e===`\r`?`\\r`:`\\${e}`)}function Yt(e,t,n,r){if(!e)return;let i=null;if(e instanceof F){if(r.has(e))return;i=e,r.put(i),e=t.fetch(e)}if(Array.isArray(e))for(let i of e)Yt(...
L3: `+t:r.errorMessages=t}var Xe=(e,t)=>{te.set(e,t)};if(r.noExitRuntime&&(de=r.noExitRuntime),r.print&&(l=r.print),r.printErr&&(u=r.printErr),r.wasmBinary&&r.wasmBinary,r.arguments&&r...
Findings
1 Critical7 High6 Medium7 Low
CriticalTrojan Source Unicodedist/control-ui/assets/index-BOHJE7UE.js
HighInstall Time Lifecycle Scriptspackage.json
HighCloud Metadata Accessdist/control-ui/assets/index-BOHJE7UE.js
HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py
HighSemantic Analysis Limiteddist/control-ui/assets/index-BOHJE7UE.js
HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js
HighKnown Malware Source Similarityscripts/preinstall-package-manager-warning.mjs
HighPrevious Version Dangerous Deltascripts/preinstall-package-manager-warning.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/control-ui/assets/pdf.worker-Cs7OcXTM.js
Affected versions and remediation
This report applies to sealclaw@2026.8.20.
See all versions of sealclaw for other recorded verdicts.
- Review the evidence and your use of sealclaw@2026.8.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.