registry / sealclaw / 2026.8.30

sealclaw@2026.8.30

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic mutation of agent plugin state and another installed package is a real lifecycle risk that warrants a warning. The inspected implementation does not establish concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install or another package-manager lifecycle install

Impact

Changes the package state directory and matching pi-ai provider files without an explicit command.

Mechanism

Automatic plugin-state migration and dependency source rewrite

AI rationale

Evidence

package.jsonscripts/postinstall-bundled-plugins.mjsdist/plugin-registry-migration-vzddrTlD.jsscripts/postinstall-patch-pi-ai.mjs~/.sealseek/plugins/installs.jsonnode_modules/@mariozechner/pi-ai/dist/providers/openai-completions.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-responses-shared.js

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

Install hooks run automatically.
Postinstall imports and runs a plugin-registry migration that persists state.
Postinstall rewrites matching files in the separately installed pi-ai dependency.

Evidence against

The preinstall hook only emits a package-manager warning.
The dependency patch is anchored, idempotent, and contains no network request.
No self-dependency or lifecycle network activity was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

dist/status.gather-wmeq-vkA.jsView file

41//#region src/cli/daemon-cli/status.gather.ts L42: const gatewayProbeAuthModuleLoader = createLazyImportLoader(() => import("./probe-auth-CLFPRs2Q.js")); L43: const daemonInspectModuleLoader = createLazyImportLoader(() => import("./inspect-Bo3ZmD8s.js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/status.gather-wmeq-vkA.jsView on unpkg · L41

dist/cli-BZ3Mf4XU.jsView file

Lines 2-42javascript

2import { f as FsSafeError } from "./path-DSyl_wQR.js";

3import { a as root } from "./filename-B77PYM5d.js";

4import { h as pathExists } from "./fs-safe-BzPvEfh_.js";

dist/control-ui/assets/index-DB8UzGJG.jsView file

6694contains invisible/control Unicode U+200C (zero width non-joiner) `}var h3=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DB8UzGJG.jsView on unpkg · L6694

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-DB8UzGJG.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c4bdbcef6302f825 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 shingleOverlap = 16 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

Findings

1 Critical5 High8 Medium7 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-DB8UzGJG.js

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-DB8UzGJG.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Fingerprint Signaturedist/plugin-sdk/plugin-test-contracts.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/proxy-cli.runtime-10qiXFVc.js

MediumDynamic Requiredist/status.gather-wmeq-vkA.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to sealclaw@2026.8.30.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.8.30 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 04:15:58.214Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.