sealclaw@2026.8.8: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sealclaw@2026.8.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-CeRhHn5x.jsView file

764patternName = generic_password severity = medium line = 764 matchedText = url.pass...ed";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-CeRhHn5x.jsView on unpkg · L764

dist/control-ui/assets/sheet-runtime.iife-CoXdO9_K.jsView file

5\`),e},r.prototype.getBackgroundByFill=function(e,t){var n=e.getInnerElements("patternFill");if(n!=null){var u=n[0],d=u.getInnerElements("fgColor"),m=u.getInnerElements("bgColor"),... L6: \\0\`,$+=f(_,2),$+=q.magic,$+=f(b,2),$+=f(w,2),$+=f(R.crc32,4),$+=f(R.compressedSize,4),$+=f(R.uncompressedSize,4),$+=f(z.length,2),$+=f(W.length,2),{fileRecord:n.LOCAL_FILE_HEADER... L7: \`)}openNode(n,u){const d=this.tos,m=this._xml;d&&this.open&&m.push(">"),this._stack.push(n),m.push("<"),m.push(n),r(m,u),this.leaf=!0,this.open=!0}addAttribute(n,u){if(!this.open)...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/control-ui/assets/sheet-runtime.iife-CoXdO9_K.jsView on unpkg · L5

dist/advertiser-DkFeU005.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sealclaw@2026.8.5 matchedIdentity = npm:c2VhbGNsYXc:2026.8.5 similarity = 0.367 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/advertiser-DkFeU005.jsView on unpkg

74//#region [redacted].ts L75: const childProcessModule = createRequire(import.meta.url)("node:child_process"); L76: const WATCHDOG_INTERVAL_MS = 5e3;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/advertiser-DkFeU005.jsView on unpkg · L74

dist/control-ui/assets/index-B1NoUHuZ.jsView file

6284contains invisible/control Unicode U+200C (zero width non-joiner) `}var t4=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B1NoUHuZ.jsView on unpkg · L6284

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/close-reason-JVI5L815.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/close-reason-JVI5L815.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1474-1515json

1474 "mac:package": "bash scripts/package-mac-app.sh",

1475 "mac:restart": "bash scripts/restart-mac.sh",

1476 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1477 "openclaw": "node scripts/run-node.mjs",

1478 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1479 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1480 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1481 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1482 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1483 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1484 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1485 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1486 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1487 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1488 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1489 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1490 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1491 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1492 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1493 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1494 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1494

1495 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1495

1496 "prepush:ci": "bash scripts/prepush-ci.sh",

1497 "probe:anthropic:prompt": "node --import tsx scripts/anthropic-prompt-probe.ts",

1498 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1499 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1500 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1501 "protocol:check": "pnpm protocol:gen && pnpm protocol:gen:swift && git diff --exit-code -- dist/protocol.schema.json apps/macos/Sources/OpenClawProtocol/GatewayModels.swift apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift",

1502 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1503 "protocol:gen:swift": "node --import tsx scripts/protocol-gen-swift.ts",

1504 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1505 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1506 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1507 "proxy:run": "node scripts/run-node.mjs proxy run",

1508 "proxy:start": "node scripts/run-node.mjs proxy start",

1509 "qa:e2e": "node --import tsx scripts/qa-e2e.ts",

1510 "qa:lab:build": "vite build --config extensions/qa-lab/web/vite.config.ts",

1511 "qa:lab:ui": "pnpm openclaw qa ui",

1512 "qa:lab:up": "node --import tsx scripts/qa-lab-up.ts",

1513 "qa:lab:up:fast": "node --import tsx scripts/qa-lab-up.ts --use-prebuilt-image --bind-ui-dist --skip-ui-build",

1514 "qa:lab:watch": "vite build --watch --config extensions/qa-lab/web/vite.config.ts",

1515 "release-metadata:check": "node scripts/check-release-metadata-only.mjs",

dist/proxy-cli.runtime-CeRhHn5x.jsView file

Lines 744-784javascript

744 env: childEnv,

745 cwd: process$1.cwd()

746 });

747 child.once("error", reject);

748 child.once("exit", (code, signal

dist/control-ui/assets/sheet-runtime.iife-CoXdO9_K.jsView file

5\`),e},r.prototype.getBackgroundByFill=function(e,t){var n=e.getInnerElements("patternFill");if(n!=null){var u=n[0],d=u.getInnerElements("fgColor"),m=u.getInnerElements("bgColor"),... L6: \\0\`,$+=f(_,2),$+=q.magic,$+=f(b,2),$+=f(w,2),$+=f(R.crc32,4),$+=f(R.compressedSize,4),$+=f(R.uncompressedSize,4),$+=f(z.length,2),$+=f(W.length,2),{fileRecord:n.LOCAL_FILE_HEADER... L7: \`)}openNode(n,u){const d=this.tos,m=this._xml;d&&this.open&&m.push(">"),this._stack.push(n),m.push("<"),m.push(n),r(m,u),this.leaf=!0,this.open=!0}addAttribute(n,u){if(!this.open)...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/control-ui/assets/sheet-runtime.iife-CoXdO9_K.jsView on unpkg · L5

dist/advertiser-DkFeU005.jsView file

Lines 54-94javascript

54 if (CIAO_INTERFACE_ASSERTION_MESSAGE_RE.test(message)) return {

55 kind: "interface-assertion",

56 formatted

57 };

58 if (CIAO_NETMASK_ASSERTION_MESSAGE_RE.test(message)) return

dist/control-ui/assets/index-B1NoUHuZ.jsView file

6284contains invisible/control Unicode U+200C (zero width non-joiner) `}var t4=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B1NoUHuZ.jsView on unpkg · L6284

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/close-reason-JVI5L815.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/close-reason-JVI5L815.jsView on unpkg