registry / sealclaw / 2026.9.28

sealclaw@2026.9.28

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Inspected source shows package-aligned lifecycle maintenance and explicitly invoked wiki setup, with no confirmed attack behavior. The scanner flags did not establish malicious execution or agent-control hijacking.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation triggers lifecycle helpers; wiki initialization requires a user-invoked CLI command.

Impact

No credential theft, hidden payload execution, or unconsented broad agent-control mutation was established.

Mechanism

The postinstall helpers maintain bundled plugin files and conditionally patch two known pi-ai usage-cost code paths. The wiki command creates missing documentation files in its configured vault.

AI rationale

Evidence

package.jsonscripts/preinstall-package-manager-warning.mjsscripts/postinstall-bundled-plugins.mjsscripts/postinstall-patch-pi-ai.mjsdist/audit.nondeep.runtime-CAvA7e13.jsdist/cli-D6hhYBSL.jsdist/plugin-sdk/plugin-test-contracts.jsskills/llm-wiki-ingest/tests/test_ingest_scripts.pydist/control-ui/assets/index-BTFXLjRb.js

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json limits automatic lifecycle actions to a package-manager notice and two postinstall helpers; the prepare hook configures Git hooks.
The preinstall helper detects the package manager and prints a warning; it does not install or execute a payload.
The plugin audit code enumerates the package's own extensions directory.
The wiki CLI creates AGENTS.md and wiki files only when explicitly invoked, using write-if-missing behavior.
The flagged child-process call is in a direct import smoke-test helper and invokes Node with supplied test code.
The required UI file is a generated frontend bundle; its flagged content did not establish an executable attack.

Evidence against

Postinstall includes a helper that conditionally patches specific installed pi-ai files to pass through usage cost data.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Source & flagged code

12 flagged

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/channel-entry-contract-D5iL7RmB.jsView file

11//#region src/plugin-sdk/channel-entry-contract.ts L12: const nodeRequire = createRequire(import.meta.url); L13: const moduleLoaders = /* @__PURE__ */ new Map();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channel-entry-contract-D5iL7RmB.jsView on unpkg · L11

dist/cli-D6hhYBSL.jsView file

22import path from "node:path"; L23: import { execFile } from "node:child_process"; L24: import { createHash } from "node:crypto"; ... L230: frontmatter: {}, L231: body: content L232: }; ... L1487: try { L1488: const parsed = JSON.parse(trimmed); L1489: if (!parsed || typeof parsed !== "object" || typeof parsed.pagePath !== "string") return []; ... L3246: try { L3247: await fs$1.access(inputPath, process.platform === "win32" ? constants.F_OK : constants.X_OK); L3248: return true;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-D6hhYBSL.jsView on unpkg · L22

dist/control-ui/assets/index-BTFXLjRb.jsView file

6900contains invisible/control Unicode U+200C (zero width non-joiner) `}var g6=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-BTFXLjRb.jsView on unpkg · L6900

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/docx-preview-DMEG690f.js","assets/chunk-62oNxeRG.js","assets/jszip.min-C9xvYp-s.js","assets/pptx-preview.es-eMvLaQp... L2: import{i as e,n as t,t as n}from"./chunk-62oNxeRG.js";import{a as r,c as i,i as a,l as o,n as s,o as c,r as l,s as u,t as d,u as f}from"./lit-BpL4H2cG.js";import{t as p}from"./requ... L3: `+re+e}var F=!1;function L(e,t){if(!e||F)return``;F=!0;var n=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(t)if(t=function(){throw Error()},Object.defineProperty(t.... ... L5: `),o=i.length-1,s=a.length-1;1<=o&&0<=s&&i[o]!==a[s];)s--;for(;1<=o&&0<=s;o--,s--)if(i[o]!==a[s]){if(o!==1||s!==1)do if(o--,s--,0>s||i[o]!==a[s]){var c=` L6: `+i[o].replace(` at new `,` at `);return e.displayName&&c.includes(`<a

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/control-ui/assets/index-BTFXLjRb.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

scripts/preinstall-package-manager-warning.mjsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = scripts/preinstall-package-manager-warning.mjs matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/preinstall-package-manager-warning.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = sealclaw@2026.9.1 matchedIdentity = npm:c2VhbGNsYXc:2026.9.1 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/preinstall-package-manager-warning.mjsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/channel-entry-contract-D5iL7RmB.jsView file

11//#region src/plugin-sdk/channel-entry-contract.ts L12: const nodeRequire = createRequire(import.meta.url); L13: const moduleLoaders = /* @__PURE__ */ new Map();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/channel-entry-contract-D5iL7RmB.js

Findings

1 Critical7 High6 Medium8 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-BTFXLjRb.js

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessdist/control-ui/assets/index-BTFXLjRb.js

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-BTFXLjRb.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Similarityscripts/preinstall-package-manager-warning.mjs

HighPrevious Version Dangerous Deltascripts/preinstall-package-manager-warning.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/channel-entry-contract-D5iL7RmB.js

Affected versions and remediation

This report applies to sealclaw@2026.9.28.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.9.28 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 15:57:24.236Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.