registry / sealclaw / 2026.8.28

sealclaw@2026.8.28

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically modifies provider code belonging to the separately installed pi-ai package. This changes behavior outside the package's own directory without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or any install that runs the postinstall lifecycle hook.

Impact

A dependency shared or hoisted in the consumer project can be silently modified, affecting AI provider behavior and cost reporting.

Mechanism

Postinstall directory walk and overwrite of hoisted pi-ai provider files.

Attack narrative

During installation, package.json runs postinstall-patch-pi-ai.mjs. The script walks parent directories to find hoisted @mariozechner/pi-ai files, reads their source, replaces selected code, and writes the result back. This mutates a foreign AI dependency automatically rather than through an explicit setup command. The renamed package also retains OpenClaw repository and command identity, increasing concern that consumers may not understand what is being installed.

Rationale

The package has a concrete automatic install-time mutation of a foreign AI-agent dependency. The source does not show exfiltration, but the unconsented overwrite is sufficient install-hook abuse to block publication.

Evidence

package.jsonscripts/postinstall-patch-pi-ai.mjsnode_modules/@mariozechner/pi-ai/dist/providers/openai-completions.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-responses-shared.js

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

Its automatic postinstall invokes a script that alters another installed AI package.
That script locates hoisted pi-ai provider files and overwrites them with replacement code.
The package identity is inconsistent with its OpenClaw repository and internal command naming.

Evidence against

The observed patch changes reported cost handling and no secret collection or network exfiltration was found in the install scripts.
The flagged Python file is a conventional test module, not an embedded payload.
The flagged control-ui bundle begins as a normal Vite web asset; its unusual Unicode is consistent with bundled library data.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,922 file(s), 27.8 MB of source, external domains: 127.0.0.1, accounts.feishu.cn, accounts.larksuite.com, ai-gateway.vercel.sh, api.anthropic.com, api.cerebras.ai, api.chutes.ai, api.cloudflare.com, api.deepseek.com, api.elevenlabs.io, api.example.com, api.fireworks.ai, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.push.apple.com, api.sandbox.push.apple.com, api.x.ai, api.xcbi.top, api.xiaomimimo.com, api.z.ai, auth.openai.com, bedrock-runtime.eu-central-1.amazonaws.com, bedrock-runtime.us-east-1.amazonaws.com, brew.sh, bun.sh, chatgpt.com, claude.ai, cloudcode-pa.googleapis.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, control.example.com, d.officecli.ai, dashscope-intl.aliyuncs.com, dashscope.aliyuncs.com, demo-api.xcbi.top, dev-api.xcbi.top, developer.mozilla.org, discord.com, docs.astral.sh, docs.mistral.ai, docs.oasis-open.org, docs.openclaw.ai

Oversized source lightweight scan

dist/control-ui/assets/sheet-runtime.iife-Md8tVWuH.js3.96 MB file, sampled 256 KB

ChildProcessPossibleObfuscationHighEntropyStringsMinifiedUrlStringswww.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1408-1448json

1408 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1409 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1410 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1411 "openclaw": "node scripts/run-node.mjs",

1412 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1413 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1414 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1415 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1416 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1417 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1418 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1419 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1420 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1421 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1422 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1423 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1424 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1425 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1426 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1427 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1428 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1428

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1428

1429 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

1430 "prepush:ci": "bash scripts/prepush-ci.sh",

1431 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1432 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1433 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1434 "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",

1435 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1436 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1437 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1438 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1439 "proxy:run": "node scripts/run-node.mjs proxy run",

1440 "proxy:start": "node scripts/run-node.mjs proxy start",

1441 "release:beta-smoke": "node --import tsx scripts/release-beta-smoke.ts",

1442 "release:check": "pnpm deps:root-ownership:check && pnpm plugins:inventory:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

1443 "release:openclaw:npm:check": "node --import tsx scripts/openclaw-npm-release-check.ts",

1444 "release:openclaw:npm:verify-published": "node --import tsx scripts/openclaw-npm-postpublish-verify.ts",

1445 "release:plugins:npm:check": "node --import tsx scripts/plugin-npm-release-check.ts",

1446 "release:plugins:npm:plan": "node --import tsx scripts/plugin-npm-release-plan.ts",

1447 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1448 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

dist/proxy-cli.runtime-10qiXFVc.jsView file

Lines 744-784javascript

744 env: childEnv,

745 cwd: process$1.cwd()

746 });

747 child.once("error", reject);

748 child.once("exit", (code, signal

dist/status.gather-wmeq-vkA.jsView file

Lines 21-61javascript

21function canUseNodeFs() {

22 const getBuiltinModule = process.getBuiltinModule;

23 if (typeof getBuiltinModule !== "function") return false;

dist/cli-BZ3Mf4XU.jsView file

Lines 2-42javascript

2import { f as FsSafeError } from "./path-DSyl_wQR.js";

3import { a as root } from "./filename-B77PYM5d.js";

4import { h as pathExists } from "./fs-safe-BzPvEfh_.js";

dist/control-ui/assets/index-K9gMl4NN.jsView file

6694contains invisible/control Unicode U+200C (zero width non-joiner) `}var f3=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-K9gMl4NN.jsView on unpkg · L6694

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-K9gMl4NN.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

dist/status.gather-wmeq-vkA.jsView file

41//#region src/cli/daemon-cli/status.gather.ts L42: const gatewayProbeAuthModuleLoader = createLazyImportLoader(() => import("./probe-auth-CLFPRs2Q.js")); L43: const daemonInspectModuleLoader = createLazyImportLoader(() => import("./inspect-Bo3ZmD8s.js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/status.gather-wmeq-vkA.jsView on unpkg · L41

dist/cli-BZ3Mf4XU.jsView file

22import path from "node:path"; L23: import { execFile } from "node:child_process"; L24: import { createHash } from "node:crypto"; ... L230: frontmatter: {}, L231: body: content L232: }; ... L1487: try { L1488: const parsed = JSON.parse(trimmed); L1489: if (!parsed || typeof parsed !== "object" || typeof parsed.pagePath !== "string") return []; ... L3246: try { L3247: await fs$1.access(inputPath, process.platform === "win32" ? constants.F_OK : constants.X_OK); L3248: return true;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-BZ3Mf4XU.jsView on unpkg · L22

dist/control-ui/assets/index-K9gMl4NN.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-K9gMl4NN.jsView on unpkg · L6694

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-K9gMl4NN.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

Findings

1 Critical3 High8 Medium7 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-K9gMl4NN.js

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-K9gMl4NN.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/proxy-cli.runtime-10qiXFVc.js

MediumDynamic Requiredist/status.gather-wmeq-vkA.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperskills/llm-wiki-ingest/tests/test_ingest_scripts.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/cli-BZ3Mf4XU.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings