registry / sealclaw / 2026.9.1

sealclaw@2026.9.1

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a concrete automatic lifecycle mutation of third-party AI dependency files, which merits a warning. Static inspection shows a bounded cost-reporting patch rather than malware behavior, so blocking is not justified.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation that runs postinstall

Impact

Changes dependency behavior and may update the package's plugin registry; no exfiltration or remote payload execution was found.

Mechanism

Postinstall rewrites pinned pi-ai provider modules and imports a plugin migration.

AI rationale

Evidence

package.jsonscripts/postinstall-patch-pi-ai.mjsscripts/postinstall-bundled-plugins.mjsnode_modules/@mariozechner/pi-ai/dist/providers/openai-completions.jsnode_modules/@mariozechner/pi-ai/dist/providers/openai-responses-shared.jsdist/commands/doctor/shared/plugin-registry-migration.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The automatic postinstall hook runs a script that locates and rewrites files in the installed pi-ai dependency.
The rewrite changes cost handling in two pi-ai OpenAI provider modules.
The other postinstall script dynamically imports a bundled plugin-registry migration and invokes it during installation.

Evidence against

The modified library is declared as a direct pinned dependency.
The patch is anchor-checked, idempotent, and limited to numeric cost passthrough.
No install-time network request, credential collection, or shell execution was found in the inspected lifecycle scripts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

11 flagged

package.jsonView file

Lines 1311-1352json

1311 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1312 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1313 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1314 "openclaw": "node scripts/run-node.mjs",

1315 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1316 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1317 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1318 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1319 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1320 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1321 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1322 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1323 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1324 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1325 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1326 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1327 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1328 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1329 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1330 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1331 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1331

1332 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1332

1333 "prepack": "node --import tsx scripts/openclaw-prepack.ts",

1334 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1335 "prepush:ci": "bash scripts/prepush-ci.sh",

1336 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1337 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1338 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1339 "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",

1340 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1341 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1342 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1343 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1344 "proxy:run": "node scripts/run-node.mjs proxy run",

1345 "proxy:start": "node scripts/run-node.mjs proxy start",

1346 "release:beta-smoke": "node --import tsx scripts/release-beta-smoke.ts",

1347 "release:check": "pnpm deps:root-ownership:check && pnpm plugins:inventory:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

1348 "release:openclaw:npm:check": "node --import tsx scripts/openclaw-npm-release-check.ts",

1349 "release:openclaw:npm:verify-published": "node --import tsx scripts/openclaw-npm-postpublish-verify.ts",

1350 "release:plugins:npm:check": "node --import tsx scripts/plugin-npm-release-check.ts",

1351 "release:plugins:npm:plan": "node --import tsx scripts/plugin-npm-release-plan.ts",

1352 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

dist/proxy-cli.runtime-10qiXFVc.jsView file

Lines 744-784javascript

744 env: childEnv,

745 cwd: process$1.cwd()

746 });

747 child.once("error", reject);

748 child.once("exit", (code, signal

dist/status.gather-wmeq-vkA.jsView file

41//#region src/cli/daemon-cli/status.gather.ts L42: const gatewayProbeAuthModuleLoader = createLazyImportLoader(() => import("./probe-auth-CLFPRs2Q.js")); L43: const daemonInspectModuleLoader = createLazyImportLoader(() => import("./inspect-Bo3ZmD8s.js"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/status.gather-wmeq-vkA.jsView on unpkg · L41

dist/cli-BZ3Mf4XU.jsView file

Lines 2-42javascript

2import { f as FsSafeError } from "./path-DSyl_wQR.js";

3import { a as root } from "./filename-B77PYM5d.js";

4import { h as pathExists } from "./fs-safe-BzPvEfh_.js";

dist/control-ui/assets/index-DD6PCesX.jsView file

6695contains invisible/control Unicode U+200C (zero width non-joiner) `}var x3=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DD6PCesX.jsView on unpkg · L6695

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/control-ui/assets/index-DD6PCesX.jsView on unpkg

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c4bdbcef6302f825 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = sealclaw@2026.8.28 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.8.28 similarity = 1.000 shingleOverlap = 16 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/proxy-cli.runtime-10qiXFVc.jsView file

764patternName = generic_password severity = medium line = 764

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/proxy-cli.runtime-10qiXFVc.jsView on unpkg · L764

Findings

1 Critical5 High8 Medium8 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-DD6PCesX.js

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-DD6PCesX.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Fingerprint Signaturedist/plugin-sdk/plugin-test-contracts.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/proxy-cli.runtime-10qiXFVc.js

MediumDynamic Requiredist/status.gather-wmeq-vkA.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to sealclaw@2026.9.1.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.9.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 08:15:13.455Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.