registry / shadow-claw / 1.32.0

shadow-claw@1.32.0

Browser-native personal AI assistant.

AI Security Review

scanned 29d ago · by lpm-firewall-ai

A running local server accepts arbitrary proxy targets. A caller can label a request as service-worker traffic by supplying headers in its body, which disables the private-address block; hostname checks also permit DNS-rebinding bypasses.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Start the server and send a request to its /proxy route with a body containing a target URL and headers.

Impact

A reachable server may fetch internal services or cloud metadata endpoints and return their responses to the requester.

Mechanism

Proxy SSRF guard bypass through a caller-controlled service-worker flag and hostname-only validation.

AI rationale

The package contains a concrete SSRF weakness in its runtime proxy, but no install lifecycle hook or evidence of covert exfiltration was found. Its agent shell and file tools are product capabilities, while the proxy bypass warrants a warning.

Evidence

src/server/routes/http-proxy.tssrc/server/utils/proxy-helpers.ts

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The server proxy marks any request with body-supplied headers as coming from a service worker.
Private-address blocking is bypassed for requests marked as service-worker traffic.
The proxy guard itself notes that hostname-only checks can be bypassed through DNS rebinding.
The package exposes an AI-agent tool dispatcher that can invoke shell and workspace mutation tools.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
The JavaScript tool deliberately blocks sensitive globals and disables network access unless enabled.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 1,512 file(s), 26.4 MB of source, external domains: 10.0.0.1, 10.0.0.2, 10.0.0.5, 10.9.8.226, 127.0.0.1, 169.254.169.254, 172.16.0.5, 172.20.0.1, 172.20.0.5, 192.168.1.1, 192.168.1.10, 192.168.1.100, 192.168.1.5, 192.168.1.50, a2ui.org, accounts.google.com, actions.google.com, agent-card.github.io, ai.google.dev, aiplatform.googleapis.com, allowed.example.com, another.com, any.example.com, api.example.com, api.external.com, api.figma.com, api.github.com, api.hf.co, api.linear.app, api.login.yahoo.com, api.myservice.com, api.nodemailer.com, api.notion.com, api.openai.com, api.telegram.org, api.test, api.test.example, app.internal, app.vssps.visualstudio.com, attacker.com, attacker.github.io, auth.atlassian.com, auth.example.com, auth.openai.com, bad.example.com, bible-tools.github.io, bit.ly, bridge.example, bridge.example.com, cdn-lfs.huggingface.co

Oversized source lightweight scan

dist/electron/main.cjs2.64 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.nodemailer.comapi.telegram.orgethereal.emailmail.google.comnodemailer.comwww.w3.org

dist/lib/orchestrator-DW5l2bbW.js2.06 MB file, sampled 256 KB

NetworkChildProcessDynamicRequireHighEntropyStringsUrlStrings127.0.0.1developer.chrome.comdocs.aws.amazon.comgithub.comhuggingface.coollama.comopenrouter.ai

dist/lib/webllm-BwoH9pq3.js6.15 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/public/agent.worker.js2.09 MB file, sampled 256 KB

FilesystemNetworkChildProcessDynamicRequireHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.notion.comapp.vssps.visualstudio.comauth.atlassian.comexample.comfeross.orggithub.comgitlab.comhuggingface.colinear.applogin.microsoftonline.comoauth2.googleapis.comopenrouter.airouter.huggingface.coslack.comwww.figma.comwww.w3.orgxt-ml.github.io

dist/public/pdf.worker.js2.06 MB file, sampled 256 KB

NetworkChildProcessDynamicRequireUrlStringsexample.com

dist/public/webllm-BDMz9yZR.js5.75 MB file, sampled 256 KB

FilesystemNetworkChildProcessHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/public/webllm-_JXFm0yh.js5.75 MB file, sampled 256 KB

FilesystemNetworkChildProcessHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/server.js2.43 MB file, sampled 256 KB

FilesystemNetworkChildProcessWebSocketHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.notion.comapp.vssps.visualstudio.comauth.atlassian.comcdn.jsdelivr.netcdnjs.cloudflare.comexample.comfonts.googleapis.comfonts.gstatic.comgithub.comgitlab.comlinear.applogin.microsoftonline.comoauth2.googleapis.comslack.comwww.figma.comwww.w3.orgwww.youtube.comxt-ml.github.io

Source & flagged code

21 flagged

dist/lib/bundler-CsL7hHMq.jsView file

Lines 1803-1843javascript

1803 mkiValue: parts[2] ? parts[2].split(":")[0] : void 0,

1804 mkiLength: parts[2] ? parts[2].split(":")[1] : void 0

1805 };

1806 };

1807 SDPUtils.writeCryptoKeyParams = function(keyParams) {

1808 return keyParams.keyMethod + ":" + keyParams.keySalt + (keyParams.lifeTime ? "|" + keyParams.lifeTime : "") + (keyParams.mkiValue && keyParams.mkiLength ? "|" + keyParams.mkiValue + ":"

1809 };

1810 SDPUtils.getCryptoParameters = function(mediaSection, sessionpart) {

1811 return SDPUtils.matchPrefix(mediaSection + sessionpart, "a=crypto:").map(SDPUtils.parseCryptoLine);

1812 };

1813 SDPUtils.getIceParameters = function(mediaSection, sessionpart) {

1814 const ufrag = SDPUtils.matchPrefix(mediaSection + sessionpart, "a=ice-ufrag:")[0];

1815 const pwd = SDPUtils.matchPrefix(mediaSection + sessionpart, "a=ice-pwd:")[0];

1816 if (!(ufrag && pwd)) return null;

1817 return {

1818 usernameFragment: ufrag.substring(12),

1819 password: pwd.substring(10)

1820 };

1821 };

1822 SDPUtils.writeIceParameters = function(params) {

1823 let sdp = "a=ice-ufrag:" + params.usernameFragment + "\r\na=ice-pwd:" + params.password + "\r\n";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/bundler-CsL7hHMq.jsView on unpkg · L1823

1824 if (params.iceLite) sdp += "a=ice-lite\r\n";

1825 return sdp;

1826 };

1827 SDPUtils.parseRtpParameters = function(mediaSection) {

1828 const description = {

1829 codecs: [],

1830 headerExtensions: [],

1831 fecMechanisms: [],

1832 rtcp: []

1833 };

1834 const mline = SDPUtils.splitLines(mediaSection)[0].split(" ");

1835 description.profile = mline[2];

1836 for (let i = 3; i < mline.length; i++) {

1837 const pt = mline[i];

1838 const rtpmapline = SDPUtils.matchPrefix(mediaSection, "a=rtpmap:" + pt + " ")[0];

1839 if (rtpmapline) {

1840 const codec = SDPUtils.parseRtpMap(rtpmapline);

1841 const fmtps = SDPUtils.matchPrefix(mediaSection, "a=fmtp:" + pt + " ");

1842 codec.parameters = fmtps.length ? SDPUtils.parseFmtp(fmtps[0]) : {};

1843 codec.rtcpFeedback = SDPUtils.matchPrefix(mediaSection, "a=rtcp-fb:" + pt + " ").map(SDPUtils.parseRtcpFb);

bin/version.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execSync } from "node:child_process";

4import { readFile, writeFile, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L2

5import path from

dist/lib/markdown-BFUTPQoO.jsView file

34053//#endregion L34054: //#region node_modules/highlight.js/lib/languages/powershell.js L34055: var require_powershell = /* @__PURE__ */ __commonJSMin(((exports, module) => {

High

Shell

Package source references shell execution.

dist/lib/markdown-BFUTPQoO.jsView on unpkg · L34053

bin/rolldown.config.test.mjsView file

Lines 163-203javascript

163 const input = "const x = window.global;";

164 const result = globalShimPlugin.transform(

165 input,

166 "/node_modules/pkg/index.js",

167

bin/cli.mjsView file

Lines 158-198javascript

158 await runBuild({

159 contentRoot,

160 toolchainRoot,

161 outDir,

162 isProduction: false,

163 pagesOrigin: options.origin || process.env.PAGES_ORIGIN,

164 basePath: options.basePath || process.env.

src/service-worker/patch-service-worker-trusted-types.test.jsView file

Lines 1-21javascript

1import { describe, expect, it, jest } from "@jest/globals";

2import vm from "node:vm";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/service-worker/patch-service-worker-trusted-types.test.jsView on unpkg · L1

4import { patchServiceWorkerTrustedTypes } from

dist/electron/main.cjsView file

84${t} L85: ${r(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let n of e.split(`/`))n?.length!==0&&n!==`.`&&(n===`..`?t.pop():t.push(n));let n=`${e?.startsWith(`/`)?`/`:`... L86: `);return this.signString(h,{signingDate:n,signingRegion:c,signingService:o,eventStreamCredentials:s})}async signMessage(e,{signingDate:t=new Date,signingRegion:n,signingService:r,... L87: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L98: `)?{tag:t,value:``}:{tag:t,value:e}}let c=Object.create(null);for(let e of i)e.trim()===``&&e.includes(` L99: `)||(c[`#text`]=`#text`in c?c[`#text`]+e:e);for(let e of a)e.tag in c?Array.isArray(c[e.tag])?c[e.tag].push(e.value):c[e.tag]=[c[e.tag],e.value]:c[e.tag]=e.value;for(let[e,t]of Obj... L

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/electron/main.cjsView on unpkg · L84

84Trigger-reachable chain: manifest.main -> dist/electron/main.cjs L84: ${t} L85: ${r(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let n of e.split(`/`))n?.length!==0&&n!==`.`&&(n===`..`?t.pop():t.push(n));let n=`${e?.startsWith(`/`)?`/`:`... L86: `);return this.signString(h,{signingDate:n,signingRegion:c,signingService:o,eventStreamCredentials:s})}async signMessage(e,{signingDate:t=new Date,signingRegion:n,signingService:r,... L87: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L98: `)?{tag:t,value:``}:{tag:t,value:e}}let c=Object.create(null);for(let e of i)e.trim()===``&&e.includes(` L99: `)||(c[`#text`]=`#text`in c?c[`#text`]+e:e);for(let e of a)e.tag in c?Array.isArray(c[e.tag])?c[e.tag].push(e.value):c[e

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/electron/main.cjsView on unpkg · L84

dist/public/agent.worker.jsView file

186L187: `.substring(0,i)+r}function Ad(e){return e!=null&&(typeof e==`string`||e.nodeType&&(e.nodeType===1||e.nodeType===9||e.nodeType===11))}var jd=Pa(),Md=Object.create,Nd=Object.defineP... L188:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/public/agent.worker.jsView on unpkg · L186

1import{i as e,n as t,r as n,t as r}from"./rolldown-runtime-aKtaBQYM.js";const i=new class{loading=!1;models=new Map;getModelInfo(e){return this.models.get(e.toLowerCase())??null}re... L2: /*! @license DOMPurify 3.4.13 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.13/L... ... L186: L187: `.substring(0,i)+r}function Ad(e){return e!=null&&(typeof e==`string`||e.nodeType&&(e.nodeType===1||e.nodeType===9||e.nodeType===11))}var jd=Pa(),Md=Object.create,Nd=Object.defineP... L188: ... L978: `,0;let a=Math.max(...n.map(([e])=>typeof e==`number`?e:0))+1+r;if(a<0)return e.state.expansionStderr=(e.state.expansionStderr||``)+`bash: line ${i}: ${t.array}: bad array subscrip... L979: `,0;r=a}let i=`$

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/public/agent.worker.jsView on unpkg · L1

dist/server.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/server.js: import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{base... `).run(e.clientId,e.deviceLabel,a,e.version,i,r,t),{clientId:e.clientId,deviceLabel:e.deviceLabel,capabilities:e.capabilities,version:e.version,peerId:i||void 0,connectedAt:r,lastS... `,`utf8`)}catch{}try{let e=s.join(h(),`shadow-claw`);l.existsSync(e)||l.mkdirSync(e,{recursive:!0}),l.writeFileSync(s.join(e,`control-token.json`),JSON.stringify(o,null,2)+` `+u),ye&&(u=gt(u)),S&&Oe?O(u):u},t.setConfig=function(){let e=arguments.length>0&&arg

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/server.jsView on unpkg

1import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{base... L2: CREATE TABLE IF NOT EXISTS vapid_keys ( ... L4: public_key TEXT NOT NULL, L5: private_key TEXT NOT NULL, L6: subject TEXT NOT NULL ... L102: `+u),ye&&(u=gt(u)),S&&Oe?O(u):u},t.setConfig=function(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};nt(e),Se=!0,Ce=z,we=le},t.clearConfig=function(){$e=null,Se=... L103: `)||n,code:r,status:t},e.data.error)}return Object.assign({message:n,code:r,status:t},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};function i(e,t){switch(e)... L104: `).join(` ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server.jsView on unpkg · L1

bin/build/build.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. build:clean", { cwd: toolchainroot }); await run("npm run -s rolldown", { cwd: toolchainroot }); } await cp(toolchaindist, distpublicdir, { recursive: true }); const contentassets = join(contentroot, "assets"); if (await pathexists(contentassets)) { if (copyallassets) { await cp(contentassets, distpublicdir, { recursive: true, force: true }); } else { if (await pathexists(join(contentassets, "icons"))) { await cp( join(contentassets, "icons"), join(distpublicdir, "assets/icons"), { recursive: true, force: true }, );

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/build/build.mjsView on unpkg

dist/lib/orchestrator-DW5l2bbW.jsView file

20Cross-file remote execution chain: dist/lib/orchestrator-DW5l2bbW.js spawns dist/lib/git-Brr7JIbs.js; helper contains network access plus dynamic code execution. L20: import { a as require_define_data_property, c as require_hasown, d as require_type, f as require_es_object_atoms, h as require_stream_browserify, i as require_has_property_descript... L21: import { n as require_inflate, o as require_zstream, r as require_deflate, t as require_constants } from "./constants-DsXVuJVP.js"; L22: import { a as upsertEmailConnection, i as listEmailConnections, n as deleteEmailConnection, o as getEmailPluginManifest, r as getEmailConnection, s as listEmailPluginManifests, t a... ... L32: label: "OpenRouter API Keys", L33: href: "https://openrouter.ai/keys" L34: }, ... L1016: let output = ""; L1017: i

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib/orchestrator-DW5l2bbW.jsView on unpkg · L20

dist/public/webllm-_JXFm0yh.jsView file

•path = dist/public/webllm-_JXFm0yh.js kind = oversized_source_file sizeBytes = 6027733 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/public/webllm-_JXFm0yh.jsView on unpkg

dist/lib/git-Brr7JIbs.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = shadow-claw@1.30.0 matchedIdentity = npm:c2hhZG93LWNsYXc:1.30.0 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/git-Brr7JIbs.jsView on unpkg

15651patternName = generic_password severity = medium line = 15651

Medium

Secret Pattern

Hardcoded password in dist/lib/git-Brr7JIbs.js

dist/lib/git-Brr7JIbs.jsView on unpkg · L15651

src/subsystems/git/git.tsView file

844patternName = generic_password severity = medium line = 844

Medium

Secret Pattern

Hardcoded password in src/subsystems/git/git.ts

src/subsystems/git/git.tsView on unpkg · L844

Source & flagged code

21 flagged · loading source

dist/lib/bundler-CsL7hHMq.jsView file

1823patternName = generic_password severity = medium line = 1823

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/bundler-CsL7hHMq.jsView on unpkg · L1823

bin/version.mjsView file

2L3: import { execSync } from "node:child_process"; L4: import { readFile, writeFile, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L2

dist/lib/markdown-BFUTPQoO.jsView file

34053//#endregion L34054: //#region node_modules/highlight.js/lib/languages/powershell.js L34055: var require_powershell = /* @__PURE__ */ __commonJSMin(((exports, module) => {

High

Shell

Package source references shell execution.

dist/lib/markdown-BFUTPQoO.jsView on unpkg · L34053

bin/rolldown.config.test.mjsView file

183grayMatterPlugin.transform( L184: "return eval(str) || {};", L185: "/src/engines.js",

High

Eval

Package source references dynamic code evaluation.

bin/rolldown.config.test.mjsView on unpkg · L183

bin/cli.mjsView file

178L179: const { startServer } = await import(serverModulePath); L180:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.mjsView on unpkg · L178

src/service-worker/patch-service-worker-trusted-types.test.jsView file

1import { describe, expect, it, jest } from "@jest/globals"; L2: import vm from "node:vm";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/service-worker/patch-service-worker-trusted-types.test.jsView on unpkg · L1

dist/electron/main.cjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/electron/main.cjsView on unpkg · L84

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/electron/main.cjsView on unpkg · L84

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/electron/main.cjsView on unpkg

1var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t,n)=>()=>... L2: `).join(`\r ... L21: public_key TEXT NOT NULL, L22: private_key TEXT NOT NULL, L23: subject TEXT NOT NULL ... L85: ${r(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let n of e.split(`/`))n?.length!==0&&n!==`.`&&(n===`..`?t.pop():t.push(n));let n=`${e?.startsWith(`/`)?`/`:`... L86: `);return this.signString(h,{signingDate:n,signingRegion:c,signingService:o,eventStreamCredentials:s})}async signMessage(e,{signingDate:t=new Date,signingRegion:n,signingService:r,... L87: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L98: `)?

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/electron/main.cjsView on unpkg · L1

dist/public/agent.worker.jsView file

186L187: `.substring(0,i)+r}function Ad(e){return e!=null&&(typeof e==`string`||e.nodeType&&(e.nodeType===1||e.nodeType===9||e.nodeType===11))}var jd=Pa(),Md=Object.create,Nd=Object.defineP... L188:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/public/agent.worker.jsView on unpkg · L186

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/public/agent.worker.jsView on unpkg · L1

dist/server.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/server.jsView on unpkg

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server.jsView on unpkg · L1

127Trigger-reachable command-output exfiltration chain: scripts.start -> dist/server.js L127: /*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */ L128: if(!globalThis.DOMException)try{let{MessageChannel:e}=H(`worker_threads`),t=new e().port1,n=new ArrayBuffer;t.postMessage(n,[n,n])}catch(e){e.constructor.name===`DOMException`&&(gl... L129: --`+e;let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n),this.boundaryChars[t[n]]=!0;this.boundary=t,this.lookbehind=new Uint8Array(this.boundary.length... L130: \r ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L139: `,r:`\r`,t:` `},c,l=function(

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/server.jsView on unpkg · L127

bin/build/build.mjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/build/build.mjsView on unpkg

dist/lib/orchestrator-DW5l2bbW.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib/orchestrator-DW5l2bbW.jsView on unpkg · L20

dist/public/webllm-_JXFm0yh.jsView file

•path = dist/public/webllm-_JXFm0yh.js kind = oversized_source_file sizeBytes = 6027733 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/public/webllm-_JXFm0yh.jsView on unpkg

dist/lib/git-Brr7JIbs.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/git-Brr7JIbs.jsView on unpkg

15651patternName = generic_password severity = medium line = 15651

Medium

Secret Pattern

Hardcoded password in dist/lib/git-Brr7JIbs.js

dist/lib/git-Brr7JIbs.jsView on unpkg · L15651

src/subsystems/git/git.tsView file

844patternName = generic_password severity = medium line = 844

Medium

Secret Pattern

Hardcoded password in src/subsystems/git/git.ts

src/subsystems/git/git.tsView on unpkg · L844

Findings

3 Critical11 High10 Medium7 Low

CriticalCommand Output Exfiltrationdist/electron/main.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/electron/main.cjs

CriticalPrevious Version Dangerous Deltadist/lib/git-Brr7JIbs.js

HighChild Processbin/version.mjs

HighShelldist/lib/markdown-BFUTPQoO.js

HighEvalbin/rolldown.config.test.mjs

HighSame File Env Network Executiondist/public/agent.worker.js

HighCredential Redirect Persistencedist/server.js

HighCloud Metadata Accessdist/server.js

HighRemote Agent Bridgedist/public/agent.worker.js

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/build/build.mjs

HighCross File Remote Execution Contextdist/lib/orchestrator-DW5l2bbW.js

HighTrigger Reachable Command Output Exfiltrationdist/server.js

HighSemantic Analysis Limiteddist/electron/main.cjs

MediumSecret Patterndist/lib/bundler-CsL7hHMq.js

MediumDynamic Requirebin/cli.mjs

MediumUnsafe Vm Contextsrc/service-worker/patch-service-worker-trusted-types.test.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Filedist/public/webllm-_JXFm0yh.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/lib/git-Brr7JIbs.js

MediumSecret Patternsrc/subsystems/git/git.ts

LowScripts Present

LowWeak Cryptodist/electron/main.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to shadow-claw@1.32.0.

See version security history for other recorded verdicts.

Review the evidence and your use of shadow-claw@1.32.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-10 01:40:19.963Z (UTC).

91%Suspicious

AI assessment confidence

IntentCritical Vulnerability

TypeUnknown

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorKarl Herrick

Maintainerskherrick

Version1.32.0

Latest on npm1.49.0

PublishedSep 10, 2026

LicenseAGPL-3.0

Dependencies32

Integrityverified

Package size22.3 MB

Files2,431

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/electron/main.cjsexports mapbin → shadow-claw, shadowclaw

Runtimenode >=24

Artifact82.9 MB · 2,431 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: assert:version, build, build:clean, build:copy:all:assets +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocketHighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStringsCopyleftLicense