registry / sealclaw / 2026.8.29

sealclaw@2026.8.29

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes automatic mutation of a foreign dependency and package-owned agent extension state, but does not establish exfiltration, remote code loading, self-dependency, or destructive behavior. This warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, through postinstall.

Impact

It can alter a hoisted pi-ai installation and package-owned agent plugin state without a separate user command.

Mechanism

Automatic ancestor-resolved dependency patching and package-owned plugin registry migration.

AI rationale

Evidence

scripts/postinstall-patch-pi-ai.mjsscripts/postinstall-bundled-plugins.mjsdist/plugin-registry-migration-vzddrTlD.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-completions.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-responses-shared.jsplugins/installs.json

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The install lifecycle automatically runs both a registry migration and a dependency patch.
The patch searches ancestor directories for pi-ai and overwrites matched provider files.
The migration automatically writes the package's installed-plugin index.

Evidence against

The preinstall hook only detects the package manager and prints a warning.
The patch is limited to two named pi-ai files and fixed cost-handling replacements.
No self-dependency, network call, credential collection, or payload download was found in the inspected lifecycle code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestware

Source & flagged code

11 flagged

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

dist/status.gather-wmeq-vkA.jsView file

41//#region src/cli/daemon-cli/status.gather.ts L42: const gatewayProbeAuthModuleLoader = createLazyImportLoader(() => import("./probe-auth-CLFPRs2Q.js")); L43: const daemonInspectModuleLoader = createLazyImportLoader(() => import("./inspect-Bo3ZmD8s.js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/status.gather-wmeq-vkA.jsView on unpkg · L41

dist/cli-BZ3Mf4XU.jsView file

22import path from "node:path"; L23: import { execFile } from "node:child_process"; L24: import { createHash } from "node:crypto"; ... L230: frontmatter: {}, L231: body: content L232: }; ... L1487: try { L1488: const parsed = JSON.parse(trimmed); L1489: if (!parsed || typeof parsed !== "object" || typeof parsed.pagePath !== "string") return []; ... L3246: try { L3247: await fs$1.access(inputPath, process.platform === "win32" ? constants.F_OK : constants.X_OK); L3248: return true;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-BZ3Mf4XU.jsView on unpkg · L22

dist/control-ui/assets/index-DB8UzGJG.jsView file

6694contains invisible/control Unicode U+200C (zero width non-joiner) `}var h3=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DB8UzGJG.jsView on unpkg · L6694

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-DB8UzGJG.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c4bdbcef6302f825 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 shingleOverlap = 16 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

Findings

1 Critical5 High8 Medium7 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-DB8UzGJG.js

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-DB8UzGJG.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Fingerprint Signaturedist/plugin-sdk/plugin-test-contracts.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/proxy-cli.runtime-10qiXFVc.js

MediumDynamic Requiredist/status.gather-wmeq-vkA.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to sealclaw@2026.8.29.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.8.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 03:32:29.224Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.