registry / shadow-claw / 1.37.0

shadow-claw@1.37.0

⚠ Under review

ShadowClaw - multi-runtime AI assistant.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

No attack was confirmed in the inspected excerpts. The large bundled server remains unresolved because the alleged credential redirection and command-output transfer were not verified.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Unresolved; the inspected manifest has no npm install lifecycle trigger.

Impact

No concrete malicious impact was established from inspected source.

Mechanism

The available excerpts show build scripts, provider configuration lookup, and explicit agent workspace initialization; they do not demonstrate credential forwarding or exfiltration.

AI rationale

Inspected source does not support the scanner's alleged attack, and the manifest has no npm install lifecycle hook. Because the critical bundled server behavior remains unresolved, manual review is appropriate.

Decision evidence

public snapshot

AI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json contains no preinstall, install, or postinstall lifecycle hook; its listed version and prepack scripts are build or release tasks.
The inspected provider code resolves an in-flight provider configuration; this excerpt does not establish credential redirection.
Agent workspace initialization is an explicit CLI function and creates directories beneath the selected workspace.

Evidence against

Static hints allege credential redirection and command-output exfiltration in dist/server.js, but those behaviors were not verified from source excerpts.
The required review spans large bundled files and reports analysis limits, so the hinted behavior could not be resolved confidently.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 1,845 file(s), 41.8 MB of source, external domains: 10.0.0.1, 10.0.0.2, 10.0.0.5, 10.9.8.226, 127.0.0.1, 169.254.169.254, 169.254.170.2, 172.16.0.5, 172.20.0.1, 172.20.0.5, 192.168.1.1, 192.168.1.10, 192.168.1.100, 192.168.1.5, 192.168.1.50, a2ui.org, accounts.google.com, actions.google.com, agent-card.github.io, ai.google.dev, aiplatform.googleapis.com, allowed.example.com, another.com, any.example.com, api.example.com, api.external.com, api.figma.com, api.github.com, api.hf.co, api.linear.app, api.login.yahoo.com, api.myservice.com, api.nodemailer.com, api.notion.com, api.openai.com, api.telegram.org, api.test, api.test.example, api.weather.com, app.internal, app.vssps.visualstudio.com, attacker.com, attacker.github.io, auth.atlassian.com, auth.example.com, auth.openai.com, bad.example.com, bible-tools.github.io, bit.ly, bridge.example

Oversized source lightweight scan

dist/cli/chunk-CvKmsXS0.js5.75 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/cli/chunk-D_-GW0aJ.js5.75 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/headless-agent.js6.79 MB file, sampled 256 KB

FilesystemNetworkDynamicRequireHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.notion.comapp.vssps.visualstudio.comauth.atlassian.comcdn.jsdelivr.netdeepwiki.comexample.comgithub.comgitlab.comhuggingface.colinear.applogin.microsoftonline.comoauth2.googleapis.comopenrouter.airouter.huggingface.coslack.comwww.figma.comwww.w3.orgxt-ml.github.io

dist/lib/webllm-BwoH9pq3.js6.15 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/public/webllm-BDMz9yZR.js5.75 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

Source & flagged code

15 flagged

bin/version.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * @fileoverview CLI runner for version command, delegating to src/cli/tools/version.js.

5 */

7import { execFileSync } from "node:child_process";

8import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L6

9import { dirname, join } from "node:path";

10import process from "node:process";

11import { fileURLToPath } from "node:url";

13const __dirname = dirname(fileURLToPath(import.meta.url));

14const distTarget = join(__dirname, "../dist/cli/tools/version.js");

16if (!existsSync(distTarget)) {

17 const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";

18 execFileSync(npmCmd, ["run", "-s", "build:cli"], {

19 cwd: join(__dirname, ".."),

20 stdio: "inherit",

21 });

22}

24const { runVersion } = await import("../dist/cli/tools/version.js");

26runVersion().catch((err) => {

dist/electron/main.cjsView file

875`).trim(),n=``,r=t.length===0,i=!1,a=e=>{if(i||!e)return e;let t=e.replace(/^\s*ASSISTANT:\s*/i,``);return t!==e&&(i=!0),t};return{push(e){let i=String(e||``).replace(/\r\n/g,` L876: `);if(r)return a(i);n+=i;let o=n.trimStart();if(t.startsWith(o)&&o.length<t.length)return``;r=!0;let s=n,c=n.trimStart();return c.startsWith(t)&&(s=c.slice(t.length)),n=``,a(s)},fl... L877:

High

Shell

Package source references shell execution.

dist/electron/main.cjsView on unpkg · L875

1var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t,n)=>()=>... L2: `).join(`\r ... L21: public_key TEXT NOT NULL, L22: private_key TEXT NOT NULL, L23: subject TEXT NOT NULL ... L85: ${r(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let n of e.split(`/`))n?.length!==0&&n!==`.`&&(n===`..`?t.pop():t.push(n));let n=`${e?.startsWith(`/`)?`/`:`... L86: `);return this.signString(h,{signingDate:n,signingRegion:c,signingService:o,eventStreamCredentials:s})}async signMessage(e,{signingDate:t=new Date,signingRegion:n,signingService:r,... L87: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L98: `)?

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/electron/main.cjsView on unpkg · L1

src/components/shadow-claw-file-viewer/iframe-storage-bridge.test.tsView file

Lines 6-46typescript

6import path from "node:path";

7import { fileURLToPath } from "node:url";

9const __filename = fileURLToPath(import.meta

dist/server.jsView file

127/*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */ L128: if(!globalThis.DOMException)try{let{MessageChannel:e}=H(`worker_threads`),t=new e().port1,n=new ArrayBuffer;t.postMessage(n,[n,n])}catch(e){e.constructor.name===`DOMException`&&(gl... L129: --`+e;let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n),this.boundaryChars[t[n]]=!0;this.boundary=t,this.lookbehind=new Uint8Array(this.boundary.length... L130: \r ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L139: `,r:`\r`,t:` `},c,l=function(e){throw{name:`SyntaxError`,message:e,at:a,text:c}},u=function(e){return e&&e!==o&&l(

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/server.jsView on unpkg · L127

127Trigger-reachable chain: scripts.start -> dist/server.js L127: /*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */ L128: if(!globalThis.DOMException)try{let{MessageChannel:e}=H(`worker_threads`),t=new e().port1,n=new ArrayBuffer;t.postMessage(n,[n,n])}catch(e){e.constructor.name===`DOMException`&&(gl... L129: --`+e;let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n),this.boundaryChars[t[n]]=!0;this.boundary=t,this.lookbehind=new Uint8Array(this.boundary.length... L130: \r ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L139: `,r:`\r`,t:` `},c,l=function(e){throw{name:`SyntaxError`,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server.jsView on unpkg · L127

src/worker/utils/native-eval-executor.tsView file

Lines 1-38typescript

1import { runInNewContext } from "node:vm";

2import type { HeadlessEvalExecutor } from "./sandboxedEval.js";

3import { setHeadlessEvalExecutor } from "./sandboxedEval.js";

5/**

src/cli/commands/agent.tsView file

Lines 44-84typescript

44]);

46const DEFAULT_SERVER_GROUP_ID = "server:main";

48import { loadWorkspaceConfig } from "../utils/load-workspace-config.js";

49export { loadWorkspaceConfig };

dist/cli/chunk-cSDRY3hS.jsView file

28Cross-file remote execution chain: dist/cli/chunk-cSDRY3hS.js spawns dist/cli/chunk-CNTNsToa.js; helper contains network access plus dynamic code execution. L28: Available modules: L29: fs, path, child_process, process, console, L30: os, url, assert, util, events, buffer, stream, ... L43: child_process: L44: execSync(cmd) throws on non-zero exit, returns stdout L45: spawnSync(cmd, args) returns { stdout, stderr, status } ... L49: L50: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L51: EOL, cpus(), endianness() L52: L53: url: URL, URLSearchParams, parse(), format() L54:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/chunk-cSDRY3hS.jsView on unpkg · L28

dist/cli/chunk-CvKmsXS0.jsView file

•path = dist/cli/chunk-CvKmsXS0.js kind = oversized_source_file sizeBytes = 6027408 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli/chunk-CvKmsXS0.jsView on unpkg

dist/cli/chunk-CFhvwUeL.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/chunk-CFhvwUeL.jsView on unpkg

Source & flagged code

15 flagged · loading source

bin/version.mjsView file

6L7: import { execFileSync } from "node:child_process"; L8: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L6

dist/electron/main.cjsView file

High

Shell

Package source references shell execution.

dist/electron/main.cjsView on unpkg · L875

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/electron/main.cjsView on unpkg · L1

src/components/shadow-claw-file-viewer/iframe-storage-bridge.test.tsView file

26// eslint-disable-next-line no-eval L27: eval(scriptCode); L28: });

High

Eval

Package source references dynamic code evaluation.

src/components/shadow-claw-file-viewer/iframe-storage-bridge.test.tsView on unpkg · L26

dist/server.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/server.jsView on unpkg · L127

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server.jsView on unpkg · L127

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/server.js: import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{base... `).run(e.clientId,e.deviceLabel,a,e.version,i,r,t),{clientId:e.clientId,deviceLabel:e.deviceLabel,capabilities:e.capabilities,version:e.version,peerId:i||void 0,connectedAt:r,lastS... `,`utf8`)}catch{}try{let e=s.join(h(),`shadow-claw`);l.existsSync(e)||l.mkdirSync(e,{recursive:!0}),l.writeFileSync(s.join(e,`control-token.json`),JSON.stringify(o,null,2)+` `+u),ye&&(u=gt(u)),S&&Oe?O(u):u},t.setConfig=function(){let e=arguments.length>0&&arg

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/server.jsView on unpkg

1import e,{createRequire as t}from"node:module";import n from"process";import{env as r,exit as i}from"node:process";import a from"node:http";import o from"node:https";import s,{base... L2: CREATE TABLE IF NOT EXISTS vapid_keys ( ... L4: public_key TEXT NOT NULL, L5: private_key TEXT NOT NULL, L6: subject TEXT NOT NULL ... L102: `+u),ye&&(u=gt(u)),S&&Oe?O(u):u},t.setConfig=function(){let e=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};nt(e),Se=!0,Ce=z,we=le},t.clearConfig=function(){$e=null,Se=... L103: `)||n,code:r,status:t},e.data.error)}return Object.assign({message:n,code:r,status:t},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};function i(e,t){switch(e)... L104: `).join(` ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server.jsView on unpkg · L1

127Trigger-reachable command-output exfiltration chain: scripts.start -> dist/server.js L127: /*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */ L128: if(!globalThis.DOMException)try{let{MessageChannel:e}=H(`worker_threads`),t=new e().port1,n=new ArrayBuffer;t.postMessage(n,[n,n])}catch(e){e.constructor.name===`DOMException`&&(gl... L129: --`+e;let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n),this.boundaryChars[t[n]]=!0;this.boundary=t,this.lookbehind=new Uint8Array(this.boundary.length... L130: \r ... L138: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L139: `,r:`\r`,t:` `},c,l=function(

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/server.jsView on unpkg · L127

130\r L131: `),r=!1,i=!1,a;e.on(`response`,e=>{let{headers:t}=e;r=t[`transfer-encoding`]===`chunked`&&!t[`content-length`]}),e.on(`socket`,o=>{let s=()=>{if(r&&!i){let e=Error(`Premature close... L132: `;yield n}static#a;static#o;static async#s(){return this.#a||=(await Promise.resolve().then(()=>Pe(Hi()))).HttpsProxyAgent,this.#a}static async#c(){let e=typeof window<`u`&&!!windo...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L130

src/worker/utils/native-eval-executor.tsView file

18TextEncoder, L19: TextDecoder, L20: JSON, ... L28: clearTimeout, L29: data: data ?? "", L30: $PIPE_DATA: data ?? "",

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/worker/utils/native-eval-executor.tsView on unpkg · L18

src/cli/commands/agent.tsView file

64const resolved = await resolveCacheDir({ L65: contentRoot: process.cwd(), L66: cacheDir: options.cacheDir, ... L72: stdin: options.stdin, L73: stdout: options.stdout, L74: }); ... L106: : Boolean( L107: process.env.CI && L108: !["0", "false"].includes(process.env.CI.toLowerCase()), ... L140: const defaultConfig = { L141: $schema: "https://json-schema.org/draft/2020-12/schema", L142: site: {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/cli/commands/agent.tsView on unpkg · L64

dist/cli/chunk-cSDRY3hS.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/chunk-cSDRY3hS.jsView on unpkg · L28

dist/cli/chunk-CvKmsXS0.jsView file

•path = dist/cli/chunk-CvKmsXS0.js kind = oversized_source_file sizeBytes = 6027408 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli/chunk-CvKmsXS0.jsView on unpkg

dist/cli/chunk-CFhvwUeL.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/chunk-CFhvwUeL.jsView on unpkg

Findings

2 Critical9 High6 Medium7 Low

CriticalCommand Output Exfiltrationdist/server.js

CriticalTrigger Reachable Dangerous Capabilitydist/server.js

HighChild Processbin/version.mjs

HighShelldist/electron/main.cjs

HighEvalsrc/components/shadow-claw-file-viewer/iframe-storage-bridge.test.ts

HighCredential Redirect Persistencedist/server.js

HighSandbox Evasion Gated Capabilitysrc/cli/commands/agent.ts

HighCloud Metadata Accessdist/server.js

HighCross File Remote Execution Contextdist/cli/chunk-cSDRY3hS.js

HighTrigger Reachable Command Output Exfiltrationdist/server.js

HighSemantic Analysis Limiteddist/cli/chunk-CFhvwUeL.js

MediumDynamic Requiredist/server.js

MediumUnsafe Vm Contextsrc/worker/utils/native-eval-executor.ts

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/cli/chunk-CvKmsXS0.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/electron/main.cjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to shadow-claw@1.37.0.

See version security history for other recorded verdicts.

Review the evidence and your use of shadow-claw@1.37.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 21:09:14.687Z (UTC).

68%Manual Review

AI assessment confidence

IntentUnknown

TypeUnknown

False-positive riskMedium

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorKarl Herrick

Maintainerskherrick

Version1.37.0

Latest on npm1.49.0

PublishedSep 19, 2026

LicenseAGPL-3.0

Dependencies34

Integrityverified

Package size33.1 MB

Files2,780

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/electron/main.cjsexports mapbin → shadow-claw, shadowclaw

Runtimenode >=24

Artifact106 MB · 2,780 files2 signature(s) · provenance

Install lifecycleNo install hooks · other: assert:version, build, build:clean, build:cli +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStringsCopyleftLicense