registry / sealclaw / 2026.9.23

sealclaw@2026.9.23

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The inspected install hook only warns about the detected package manager, and the flagged CLI excerpt creates wiki documentation files. The right-to-left override in the control UI bundle remains unexplained, so a warning is appropriate without claiming an active attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Loading the control UI bundle.

Impact

No concrete harmful effect was established.

Mechanism

The bundle includes unusual Unicode data; its role and executable effect remain unresolved from the inspected excerpt.

AI rationale

Evidence

dist/control-ui/assets/index-BTFXLjRb.js

Decision evidence

public snapshot

AI called this Suspicious at 68.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The control UI bundle contains a right-to-left override character amid unusual Unicode data; static inspection did not establish its purpose.
The preinstall hook detects the package manager and prints a warning for non-pnpm installs.
The flagged CLI code writes generated AGENTS.md and WIKI.md files; this excerpt does not show agent configuration or plugin installation.
The audit code inspects installed plugin directories, while the plugin SDK contract detects import-time side effects.
The flagged Python file is a test helper that loads scripts for tests.

Evidence against

The manifest’s preinstall command runs the package-manager warning script; the inspected warning code does not mutate files or contact a network endpoint.
No concrete credential collection, exfiltration, persistence, or destructive behavior was established in the inspected excerpts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

12 flagged

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/channel-entry-contract-D5iL7RmB.jsView file

11//#region src/plugin-sdk/channel-entry-contract.ts L12: const nodeRequire = createRequire(import.meta.url); L13: const moduleLoaders = /* @__PURE__ */ new Map();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channel-entry-contract-D5iL7RmB.jsView on unpkg · L11

dist/cli-D6hhYBSL.jsView file

22import path from "node:path"; L23: import { execFile } from "node:child_process"; L24: import { createHash } from "node:crypto"; ... L230: frontmatter: {}, L231: body: content L232: }; ... L1487: try { L1488: const parsed = JSON.parse(trimmed); L1489: if (!parsed || typeof parsed !== "object" || typeof parsed.pagePath !== "string") return []; ... L3246: try { L3247: await fs$1.access(inputPath, process.platform === "win32" ? constants.F_OK : constants.X_OK); L3248: return true;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-D6hhYBSL.jsView on unpkg · L22

dist/control-ui/assets/index-BTFXLjRb.jsView file

6900contains invisible/control Unicode U+200C (zero width non-joiner) `}var g6=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-BTFXLjRb.jsView on unpkg · L6900

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/docx-preview-DMEG690f.js","assets/chunk-62oNxeRG.js","assets/jszip.min-C9xvYp-s.js","assets/pptx-preview.es-eMvLaQp... L2: import{i as e,n as t,t as n}from"./chunk-62oNxeRG.js";import{a as r,c as i,i as a,l as o,n as s,o as c,r as l,s as u,t as d,u as f}from"./lit-BpL4H2cG.js";import{t as p}from"./requ... L3: `+re+e}var F=!1;function L(e,t){if(!e||F)return``;F=!0;var n=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(t)if(t=function(){throw Error()},Object.defineProperty(t.... ... L5: `),o=i.length-1,s=a.length-1;1<=o&&0<=s&&i[o]!==a[s];)s--;for(;1<=o&&0<=s;o--,s--)if(i[o]!==a[s]){if(o!==1||s!==1)do if(o--,s--,0>s||i[o]!==a[s]){var c=` L6: `+i[o].replace(` at new `,` at `);return e.displayName&&c.includes(`<a

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/control-ui/assets/index-BTFXLjRb.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

scripts/preinstall-package-manager-warning.mjsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = scripts/preinstall-package-manager-warning.mjs matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/preinstall-package-manager-warning.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = sealclaw@2026.9.1 matchedIdentity = npm:c2VhbGNsYXc:2026.9.1 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/preinstall-package-manager-warning.mjsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/channel-entry-contract-D5iL7RmB.jsView file

11//#region src/plugin-sdk/channel-entry-contract.ts L12: const nodeRequire = createRequire(import.meta.url); L13: const moduleLoaders = /* @__PURE__ */ new Map();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channel-entry-contract-D5iL7RmB.js

Findings

1 Critical7 High6 Medium8 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-BTFXLjRb.js

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessdist/control-ui/assets/index-BTFXLjRb.js

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-BTFXLjRb.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Similarityscripts/preinstall-package-manager-warning.mjs

HighPrevious Version Dangerous Deltascripts/preinstall-package-manager-warning.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/channel-entry-contract-D5iL7RmB.js

Affected versions and remediation

This report applies to sealclaw@2026.9.23.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.9.23 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 15:57:04.004Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.