registry / sealclaw / 2026.8.31

sealclaw@2026.8.31

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes unconsented install-time mutation outside the package, but not a concrete theft, remote execution, or broad foreign agent-control takeover. Treat this as a lifecycle-risk warning rather than malware.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the preinstall and postinstall hooks.

Impact

A consumer's shared pi-ai installation can be modified without an explicit command, and existing SealClaw plugin state can be changed or cleaned up.

Mechanism

Automatic dependency patching and package-owned plugin-state migration.

AI rationale

Evidence

package.jsonscripts/postinstall-patch-pi-ai.mjsscripts/postinstall-bundled-plugins.mjsdist/plugin-registry-migration-vzddrTlD.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-completions.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-responses-shared.js~/.sealseek/plugins/installs.json~/.sealseek/plugin-runtime-deps~/.clawdbot/plugin-runtime-deps

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The automatic postinstall rewrites two files in a hoisted third-party AI library.
Postinstall imports a migration module that writes the package's plugin index into the user's state directory.
The lifecycle cleanup recursively deletes legacy package plugin dependency state and selected symlinks.

Evidence against

The preinstall hook only detects the package manager and prints a warning.
The third-party patch is a fixed, anchored cost-field change; it has no network or command execution.
No runtime dependency on sealclaw itself was found in package.json.
No credential collection or network exfiltration was found in the inspected lifecycle code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

11 flagged

package.jsonView file

Lines 1408-1449json

1408 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1409 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1410 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1411 "openclaw": "node scripts/run-node.mjs",

1412 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1413 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1414 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1415 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1416 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1417 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1418 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1419 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1420 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1421 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1422 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1423 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1424 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1425 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1426 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1427 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1428 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1428

1429 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1429

1430 "prepush:ci": "bash scripts/prepush-ci.sh",

1431 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1432 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1433 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1434 "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",

1435 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1436 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1437 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1438 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1439 "proxy:run": "node scripts/run-node.mjs proxy run",

1440 "proxy:start": "node scripts/run-node.mjs proxy start",

1441 "release:beta-smoke": "node --import tsx scripts/release-beta-smoke.ts",

1442 "release:check": "pnpm deps:root-ownership:check && pnpm plugins:inventory:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

1443 "release:openclaw:npm:check": "node --import tsx scripts/openclaw-npm-release-check.ts",

1444 "release:openclaw:npm:verify-published": "node --import tsx scripts/openclaw-npm-postpublish-verify.ts",

1445 "release:plugins:npm:check": "node --import tsx scripts/plugin-npm-release-check.ts",

1446 "release:plugins:npm:plan": "node --import tsx scripts/plugin-npm-release-plan.ts",

1447 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1448 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1449 "start": "node scripts/run-node.mjs",

dist/proxy-cli.runtime-10qiXFVc.jsView file

Lines 744-784javascript

744 env: childEnv,

745 cwd: process$1.cwd()

746 });

747 child.once("error", reject);

748 child.once("exit", (code, signal

dist/status.gather-wmeq-vkA.jsView file

Lines 21-61javascript

21function canUseNodeFs() {

22 const getBuiltinModule = process.getBuiltinModule;

23 if (typeof getBuiltinModule !== "function") return false;

dist/cli-BZ3Mf4XU.jsView file

Lines 2-42javascript

2import { f as FsSafeError } from "./path-DSyl_wQR.js";

3import { a as root } from "./filename-B77PYM5d.js";

4import { h as pathExists } from "./fs-safe-BzPvEfh_.js";

dist/control-ui/assets/index-DB8UzGJG.jsView file

6694contains invisible/control Unicode U+200C (zero width non-joiner) `}var h3=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DB8UzGJG.jsView on unpkg · L6694

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-DB8UzGJG.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c4bdbcef6302f825 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 shingleOverlap = 16 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

Findings

1 Critical5 High8 Medium7 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-DB8UzGJG.js

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-DB8UzGJG.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Fingerprint Signaturedist/plugin-sdk/plugin-test-contracts.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/proxy-cli.runtime-10qiXFVc.js

MediumDynamic Requiredist/status.gather-wmeq-vkA.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to sealclaw@2026.8.31.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.8.31 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 04:49:31.295Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.