sealclaw@2026.8.22: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sealclaw@2026.8.22: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The automatic postinstall hook runs two filesystem-mutating scripts.
Postinstall rewrites two fixed files in the third-party @mariozechner/pi-ai dependency.
Postinstall removes legacy runtime-dependency directories under the package's state locations.
Postinstall dynamically imports a bundled plugin-registry migration that writes the package's plugin index.

Evidence against

The preinstall hook only detects the package manager and prints a warning.
The dependency patch is limited to cost passthrough code and has fixed anchors.
No network, shell execution, credential harvesting, or remote payload loading was found in the inspected lifecycle sources.
No runtime dependency on sealclaw itself was present in package.json.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,922 file(s), 27.7 MB of source, external domains: 127.0.0.1, accounts.feishu.cn, accounts.larksuite.com, ai-gateway.vercel.sh, api.anthropic.com, api.cerebras.ai, api.chutes.ai, api.cloudflare.com, api.deepseek.com, api.elevenlabs.io, api.example.com, api.fireworks.ai, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.push.apple.com, api.sandbox.push.apple.com, api.x.ai, api.xcbi.top, api.xiaomimimo.com, api.z.ai, auth.openai.com, bedrock-runtime.eu-central-1.amazonaws.com, bedrock-runtime.us-east-1.amazonaws.com, brew.sh, bun.sh, chatgpt.com, claude.ai, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, control.example.com, d.officecli.ai, dashscope-intl.aliyuncs.com, dashscope.aliyuncs.com, demo-api.xcbi.top, dev-api.xcbi.top, developer.mozilla.org, discord.com, docs.astral.sh, docs.mistral.ai, docs.oasis-open.org, docs.openclaw.ai

Oversized source lightweight scan

dist/control-ui/assets/sheet-runtime.iife-Md8tVWuH.js3.96 MB file, sampled 256 KB

ChildProcessPossibleObfuscationHighEntropyStringsMinifiedUrlStringswww.w3.org

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764 matchedText = url.pass...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

dist/status.gather-wmeq-vkA.jsView file

41//#region src/cli/daemon-cli/status.gather.ts L42: const gatewayProbeAuthModuleLoader = createLazyImportLoader(() => import("./probe-auth-CLFPRs2Q.js")); L43: const daemonInspectModuleLoader = createLazyImportLoader(() => import("./inspect-Bo3ZmD8s.js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/status.gather-wmeq-vkA.jsView on unpkg · L41

dist/control-ui/assets/index-D3mbl96K.jsView file

6693contains invisible/control Unicode U+200C (zero width non-joiner) `}var p3=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-D3mbl96K.jsView on unpkg · L6693

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-D3mbl96K.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/windows-spawn-D7GZrz9v.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/windows-spawn-zUnahlxC.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/windows-spawn-D7GZrz9v.jsView on unpkg

dist/execute.runtime-CtIowz1Q.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sealclaw@2026.8.21 matchedIdentity = npm:c2VhbGNsYXc:2026.8.21 similarity = 0.592 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/execute.runtime-CtIowz1Q.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1408-1448json

1408 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1409 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1410 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1411 "openclaw": "node scripts/run-node.mjs",

1412 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1413 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1414 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1415 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1416 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1417 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1418 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1419 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1420 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1421 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1422 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1423 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1424 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1425 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1426 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1427 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1428 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1428

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1428

1429 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

1430 "prepush:ci": "bash scripts/prepush-ci.sh",

1431 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1432 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1433 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1434 "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",

1435 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1436 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1437 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1438 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1439 "proxy:run": "node scripts/run-node.mjs proxy run",

1440 "proxy:start": "node scripts/run-node.mjs proxy start",

1441 "release:beta-smoke": "node --import tsx scripts/release-beta-smoke.ts",

1442 "release:check": "pnpm deps:root-ownership:check && pnpm plugins:inventory:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

1443 "release:openclaw:npm:check": "node --import tsx scripts/openclaw-npm-release-check.ts",

1444 "release:openclaw:npm:verify-published": "node --import tsx scripts/openclaw-npm-postpublish-verify.ts",

1445 "release:plugins:npm:check": "node --import tsx scripts/plugin-npm-release-check.ts",

1446 "release:plugins:npm:plan": "node --import tsx scripts/plugin-npm-release-plan.ts",

1447 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1448 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

dist/proxy-cli.runtime-10qiXFVc.jsView file

Lines 744-784javascript

744 env: childEnv,

745 cwd: process$1.cwd()

746 });

747 child.once("error", reject);

748 child.once("exit", (code, signal

dist/status.gather-wmeq-vkA.jsView file

Lines 21-61javascript

21function canUseNodeFs() {

22 const getBuiltinModule = process.getBuiltinModule;

23 if (typeof getBuiltinModule !== "function") return false;

dist/control-ui/assets/index-D3mbl96K.jsView file

6693contains invisible/control Unicode U+200C (zero width non-joiner) `}var p3=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-D3mbl96K.jsView on unpkg · L6693

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-D3mbl96K.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/windows-spawn-D7GZrz9v.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/windows-spawn-zUnahlxC.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/windows-spawn-D7GZrz9v.jsView on unpkg

dist/execute.runtime-CtIowz1Q.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sealclaw@2026.8.21 matchedIdentity = npm:c2VhbGNsYXc:2026.8.21 similarity = 0.592 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/execute.runtime-CtIowz1Q.jsView on unpkg