Loading npm security reports…

shieldcortex@5.2.0: Suspicious npm security report (Warn) | LPM Firewall

registry / shieldcortex / 5.2.0

shieldcortex@5.2.0

Trustworthy memory and security for AI agents. Memory firewall for any host that writes through it; runtime tool gates on Claude Code, OpenClaw, and Hermes.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A global npm install refreshes this package's own OpenClaw plugin and hook when those files already exist, and the installer also copies the same hook into Claude Code's hooks directory and can restart the OpenClaw gateway. The refresh is limited to global installs with a prior ShieldCortex OpenClaw artifact and can be skipped with an environment variable.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during a global install when ~/.openclaw exists and a ShieldCortex hook or realtime plugin is already installed.

Impact

Updated package code is placed on existing agent hook and plugin load paths, and the OpenClaw gateway may restart, without a new consent prompt. Hosts with no prior ShieldCortex hook or plugin are not auto-wired.

Mechanism

scripts/postinstall.mjs runs node dist/index.js openclaw install, which copies packaged hook files into ~/.openclaw/hooks and ~/.claude/hooks and re-registers the realtime plugin, then restarts the gateway by default.

AI rationale

Global postinstall automatically rewrites this package's already installed OpenClaw hook and plugin and can also copy that hook into Claude Code's hooks directory and restart the gateway. The path is gated to a prior ShieldCortex install and does not plant a separate payload, so it is guarded first-party agent-extension lifecycle risk.

Evidence

package.jsonscripts/postinstall.mjsdist/setup/openclaw.js~/.shieldcortex/config.json~/.openclaw/hooks/cortex-memory~/.claude/hooks/cortex-memory~/.openclaw/extensions/shieldcortex-realtime

Source & flagged code

29 flagged

package.jsonView file

Lines 42-82json

42 "types": "./dist/scan-only.d.ts"

43 },

44 "./enforce": {

45 "import": "./dist/enforce.js",

46 "require": "./scripts/lib/cjs-not-supported.cjs",

47 "types": "./dist/enforce.d.ts"

48 },

49 "./environment": {

50 "import": "./dist/environment/index.js",

51 "require": "./scripts/lib/cjs-not-supported.cjs",

52 "types": "./dist/environment/index.d.ts"

53 },

54 "./lib": {

55 "import": "./dist/lib.js",

56 "require": "./scripts/lib/cjs-not-supported.cjs",

57 "types": "./dist/lib.d.ts"

58 }

59 },

60 "type": "module",

61 "scripts": {

62 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "build:ts": "node -e \"fs.rmSync('dist', { recursive: true, force: true }); fs.rmSync('plugins/openclaw/dist', { recursive: true, force: true })\" && tsc -p tsconfig.build.json && tsc -p tsconfig.openclaw-plugin.json && cp plugins/openclaw/openclaw.plugin.json plugins/openclaw/dist/ && cp src/database/schema.sql dist/database/",

64 "postbuild:ts": "node scripts/ensure-bin-executable.mjs",

65 "bootstrap:dashboard": "node -e \"if (!require('fs').existsSync('dashboard/node_modules')) { process.exit(1); }\" || (cd dashboard && npm ci --no-audit --no-fund)",

66 "build:dashboard": "npm run bootstrap:dashboard && cd dashboard && npm run build && (cp -r .next/static .next/standalone/dashboard/.next/ 2>/dev/null || true) && (cp -r public .next/standalone/dashboard/ 2>/dev/null || true) && cd .. && node scripts/prune-dashboard-standalone.mjs",

67 "build": "npm run build:ts && npm run build:dashboard",

68 "start": "node dist/index.js",

69 "start:api": "node dist/index.js --mode api",

70 "start:dashboard": "node dist/index.js --dashboard",

71 "dev": "tsx src/index.ts",

72 "dev:api": "tsx src/index.ts --mode api",

73 "dev:dashboard": "tsx src/index.ts --dashboard",

74 "watch": "tsc --watch",

75 "test": "node scripts/run-jest.mjs",

76 "test:watch": "node scripts/run-jest.mjs --watch",

77 "test:coverage": "node scripts/run-jest.mjs --coverage",

78 "test:dist": "node scripts/check-no-bare-require.mjs",

79 "guard:precision": "node scripts/run-guard-precision.mjs",

80 "bench": "tsx benchmark/longmemeval/run.ts",

81 "bench:smoke": "SHIELDCORTEX_SKIP_EMBEDDINGS=1 tsx benchmark/longmemeval/run.ts --quiet",

82 "audit:security": "npm audit --audit-level=moderate",

dist/database/init.jsView file

Lines 1-29javascript

1/**

2 * Database initialization and connection management

3 */

4import { getBetterSqlite3 } from './better-sqlite3-guard.js';

5import { NativeModuleLoadError, isNativeModuleLoadError, formatNativeLoadError } from './native-load-classify.js';

6import { existsSync, readFileSync, statSync, writeFileSync, unlinkSync, renameSync, copyFileSync, readdirSync, openSync, closeSync, realpathSync } from

dist/setup/hooks.jsView file

Lines 33-73javascript

33 const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

34 if (!config.customHooks || typeof config.customHooks !== 'object'

dist/database/better-sqlite3-guard.jsView file

Lines 1-37javascript

1/**

2 * Guarded loader for the better-sqlite3 native module.

3 *

4 * better-sqlite3 13 ships Node-API prebuilt binaries per PLATFORM (not per

5 * Node ABI), so a Node upgrade no longer strands the binding — that was the

6 * 12.x failure mode, where a Node version newer than the installed prebuilds

7 * (and with no C++ toolchain to compile from source) failed to load with a

8 * bare `libc++abi: terminating ... Napi::Error` crash-loop and zero guidance.

9 * An unsupported platform, a stripped install or a half-finished local build

hooks/openclaw/cortex-memory/handler.tsView file

Lines 34-74typescript

34// case auto-capture is simply skipped (we do NOT regrow the old high-salience

35// bespoke-extractor path). The wrapper imports nothing native; persistence

36// still flows only through callCortex's mcporter shell-out.

37const loadOpenClawExtract = runtime.loadOpenClawExtract;

38// Resolves the ShieldCortex package root from the resolved server binary (no

39// DB access). Used by selfCheckAndHeal to compare the running hook against the

40// packaged source for staleness — warn-only, never re-copies from the gateway.

dist/setup/deep-clean.jsView file

Lines 1-41javascript

1/**

2 * Deep-clean / residue detection for ShieldCortex ↔ OpenClaw integration.

3 *

4 * The standard `uninstall` and `uninstallPlugin` code paths only fire when

5 * the on-disk artefacts they expected are still present. Partial uninstalls,

6 * manual cleanups, and version-to-version shape changes left orphaned config

7 * entries in `~/.openclaw/openclaw.json` and `~/.openclaw/workspace/.clawhub/lock.json`

8 * that kept producing "plugin references without files" and "missing skill file"

9 * warnings until purged by hand (see incident notes 2026-04-23/24).

10 *

dist/index.jsView file

Lines 330-370javascript

330 return null;

331}

332/**

333 * Start the Next.js dashboard as a supervised child process.

334 *

335 * v4.27.1: if the child exits while the parent is still alive (crash, OOM,

336 * port conflict at startup, etc.), respawn it with exponential backoff

337 * (1 → 2 → 4 → 8 → 16 → 32 → 60 s, capped). Without this, a single child

338 * crash leaves the parent serving only the API on :3001 while :3030 stays

dashboard/.next/standalone/dashboard/node_modules/next/dist/compiled/edge-runtime/index.jsView file

1(()=>{var __webpack_modules__={687:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dashboard/.next/standalone/dashboard/node_modules/next/dist/compiled/edge-runtime/index.jsView on unpkg · L1

dashboard/.next/standalone/dashboard/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1View file

36const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path")); L37: const _nodechild_process = require("node:child_process"); L38: const _crossspawn = /*#__PURE__*/ _interop_require_default(require("next/dist/compiled/cross-spawn")); ... L49: try { L50: packageJsonPath = (0, _resolvefrom.resolveFrom)(baseDir, "typescript/package.json"); L51: } catch { ... L53: } L54: const packageJson = JSON.parse((0, _nodefs.readFileSync)(packageJsonPath, "utf8")); L55: const packageDir = _nodepath.default.dirname(packageJsonPath); ... L98: return new Promise((resolve, reject)=>{ L99: var _child_stdout, _child_stderr; L100: const child = (0, _crossspawn.default)(process.execPath, [

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dashboard/.next/standalone/dashboard/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1View on unpkg · L36

dist/setup/uninstall.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: function blockagentuninstall() { if (isagentcontext()) { console.error('\n[shieldcortex] blocked: uninstall attempted from agent context.'); console.error('sub-agents cannot uninstall shieldcortex.'); console.error('only human operators can uninstall via interactive tty.\n'); return true; } return false; } export async function requireconfirmation(action) { if (process.argv.includes('--confirm')) { return true; } if (!process.stdi

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/uninstall.jsView on unpkg

dist/setup/openclaw.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function openclawchildenv(extra = {}, home = resolveuserhome()) { return { ...process.env, home: home, openclaw_home: home, ...extra }; } export function __openclawchildenvfortest(home) { return home === undefined ? openclawchildenv() : openclawchildenv({}, home); } function isopenclawinstalled() { try { execsync('which openclaw', { encoding: 'utf-8', timeout: 5000 }); return true; } catch {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/openclaw.jsView on unpkg

dist/service/install.jsView file

12Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/service/install.js L12: import os from 'os'; L13: import { execSync } from 'child_process'; L14: import { fileURLToPath } from 'url'; ... L16: const __filename = fileURLToPath(import.meta.url); L17: const __dirname = path.dirname(__filename); L18: function detectPlatform() { L19: switch (process.platform) { L20: case 'darwin': return 'macos'; ... L25: function detectDefaultServiceMode(platform) { L26: if (platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) { L27: return 'worker'; ... L44: // If that absolute path no longer exists, systemd will fail to open it

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service/install.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/service/install.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service/install.jsView on unpkg

plugins/hermes/shieldcortex/sc_client.pyView file

•path = plugins/hermes/shieldcortex/sc_client.py kind = build_helper sizeBytes = 14429 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/hermes/shieldcortex/sc_client.pyView on unpkg

dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.bodyView file

•path = dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 26212 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.bodyView on unpkg

plugins/hermes/shieldcortex/tests/test_shadow_parity.pyView file

•path = [redacted]test_shadow_parity.py kind = payload_in_excluded_dir sizeBytes = 19416 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/hermes/shieldcortex/tests/test_shadow_parity.pyView on unpkg

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 55

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

•matchType = token_shingles matchedPackage = shieldcortex@5.0.1 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/defence/skill-scanner/scan-skill.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/defence/skill-scanner/scan-skill.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/defence/skill-scanner/scan-skill.jsView on unpkg

dist/integrations/openclaw-gateway-roster.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/integrations/openclaw-gateway-roster.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/openclaw-gateway-roster.jsView on unpkg

dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = polyrouter@1.0.35 matchedPath = app/node_modules/@next/env/dist/index.js matchedIdentity = npm:cG9seXJvdXRlcg:1.0.35 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.jsView on unpkg

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.jsView on unpkg

dist/api/routes/xray.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/api/routes/xray.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/routes/xray.jsView on unpkg

dist/audit/dependency-scanner.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/audit/dependency-scanner.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/dependency-scanner.jsView on unpkg

dist/audit/env-scanner.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/audit/env-scanner.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/env-scanner.jsView on unpkg

dist/integrations/claude-code-version.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/integrations/claude-code-version.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/claude-code-version.jsView on unpkg

Source & flagged code

29 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/database/init.jsView file

9import { fileURLToPath } from 'url'; L10: import { execSync } from 'child_process'; L11: import { runMigrations } from './migrations.js';

High

Child Process

Package source references child process execution.

dist/database/init.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/database/init.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/database/init.jsView on unpkg

dist/setup/hooks.jsView file

53stdio: ['pipe', 'inherit', 'inherit'], L54: shell: true, L55: });

High

Shell

Package source references shell execution.

dist/setup/hooks.jsView on unpkg · L53

dist/database/better-sqlite3-guard.jsView file

17* • REQUIRING the package resolves JAVASCRIPT ONLY. `lib/index.js` is L18: * `require('./database')(require('./binding').getBinding, true)`, which L19: * hands `getBinding` over as a FUNCTION; no `.node` file is opened. So the

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/database/better-sqlite3-guard.jsView on unpkg · L17

hooks/openclaw/cortex-memory/handler.tsView file

54L55: const NOVELTY_CACHE_FILE = path.join(homedir(), ".shieldcortex", "openclaw-memory-cache.json"); L56: const DEFAULT_NOVELTY_THRESHOLD = 0.88; ... L118: try { L119: const raw = JSON.parse(await fs.readFile(NOVELTY_CACHE_FILE, "utf-8")); L120: if (!Array.isArray(raw)) return []; ... L629: const fsSync = await import("node:fs"); L630: const scDir = process.env.SHIELDCORTEX_CONFIG_DIR?.trim() || path.join(homedir(), ".shieldcortex"); L631: const cfgPath = path.join(scDir, "config.json"); ... L677: // the native driver from the package that supplied inject-pack.mjs, never L678: // relative to this copied/self-healed handler. Prefer package.json as the L679: // package-root anchor; the selected helper remains a correct ancestry anchor

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/openclaw/cortex-memory/handler.tsView on unpkg · L54

dist/setup/deep-clean.jsView file

•matchType = normalized_sha256 matchedPackage = shieldcortex@5.0.1 matchedPath = dist/setup/deep-clean.js matchedIdentity = npm:c2hpZWxkY29ydGV4:5.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/setup/deep-clean.jsView on unpkg

21import os from 'os'; L22: import { execFileSync, execSync } from 'child_process'; L23: import { gatewayRestartCommand } from './gateway-restart-command.js'; ... L33: function resolveHome() { L34: const sudoUser = process.env.SUDO_USER; L35: if (sudoUser && SAFE_USERNAME.test(sudoUser)) { ... L48: } L49: return os.homedir(); L50: } ... L54: try { L55: const parsed = JSON.parse(fs.readFileSync(file, 'utf-8')); L56: return typeof parsed === 'object' && parsed !== null

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/setup/deep-clean.jsView on unpkg · L21

dist/index.jsView file

350║ Starting Next.js dashboard... ║ L351: ║ Dashboard: http://localhost:3030 ║ L352: ║ API: http://localhost:3001 ║ ... L362: if (useStandalone && dashboardPath) { L363: return spawn(process.execPath, ['server.js'], { L364: cwd: dashboardPath.cwd, L365: stdio: ['ignore', 'pipe', 'pipe'], L366: env: { ...process.env, PORT: '3030', HOSTNAME: '127.0.0.1' }, L367: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L350

dashboard/.next/standalone/dashboard/node_modules/next/dist/compiled/edge-runtime/index.jsView file

1(()=>{var __webpack_modules__={687:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dashboard/.next/standalone/dashboard/node_modules/next/dist/compiled/edge-runtime/index.jsView on unpkg · L1

dashboard/.next/standalone/dashboard/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1View file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dashboard/.next/standalone/dashboard/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1View on unpkg · L36

dist/setup/uninstall.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/uninstall.jsView on unpkg

dist/setup/openclaw.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/openclaw.jsView on unpkg

dist/service/install.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service/install.jsView on unpkg · L12

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service/install.jsView on unpkg

plugins/hermes/shieldcortex/sc_client.pyView file

•path = plugins/hermes/shieldcortex/sc_client.py kind = build_helper sizeBytes = 14429 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/hermes/shieldcortex/sc_client.pyView on unpkg

dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.bodyView file

•path = dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 26212 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.bodyView on unpkg

plugins/hermes/shieldcortex/tests/test_shadow_parity.pyView file

•path = [redacted]test_shadow_parity.py kind = payload_in_excluded_dir sizeBytes = 19416 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/hermes/shieldcortex/tests/test_shadow_parity.pyView on unpkg

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 55

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/defence/skill-scanner/scan-skill.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/defence/skill-scanner/scan-skill.jsView on unpkg

dist/integrations/openclaw-gateway-roster.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/openclaw-gateway-roster.jsView on unpkg

dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.jsView on unpkg

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.jsView on unpkg

dist/api/routes/xray.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/routes/xray.jsView on unpkg

dist/audit/dependency-scanner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/dependency-scanner.jsView on unpkg

dist/audit/env-scanner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/env-scanner.jsView on unpkg

dist/integrations/claude-code-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/claude-code-version.jsView on unpkg

Findings

24 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/database/init.js

HighShelldist/setup/hooks.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdashboard/.next/standalone/dashboard/node_modules/next/dist/compiled/edge-runtime/index.js

HighSandbox Evasion Gated Capabilitydashboard/.next/standalone/dashboard/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationdist/setup/uninstall.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/setup/openclaw.js

HighTrigger Reachable Persistencedist/service/install.js

HighShips High Entropy Blobdashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.body

HighPayload In Excluded Dirplugins/hermes/shieldcortex/tests/test_shadow_parity.py

HighSemantic Analysis Limiteddashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1

HighKnown Malware Source Similarityscripts/postinstall.mjs

HighKnown Malware Source Similaritydist/defence/skill-scanner/scan-skill.js

HighKnown Malware Source Similaritydist/integrations/openclaw-gateway-roster.js

HighKnown Malware Source Similaritydist/service/install.js

HighKnown Malware Source Similaritydashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.js

HighKnown Malware Source Similaritydashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js

HighKnown Malware Source Similaritydist/api/routes/xray.js

HighKnown Malware Source Similaritydist/audit/dependency-scanner.js

HighKnown Malware Source Similaritydist/setup/deep-clean.js

HighKnown Malware Source Similaritydist/audit/env-scanner.js

HighKnown Malware Source Similaritydist/database/init.js

HighKnown Malware Source Similaritydist/integrations/claude-code-version.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/database/better-sqlite3-guard.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/setup/deep-clean.js

MediumShips Build Helperplugins/hermes/shieldcortex/sc_client.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptohooks/openclaw/cortex-memory/handler.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

29 flagged

package.jsonView file

Lines 42-82json

42 "types": "./dist/scan-only.d.ts"

43 },

44 "./enforce": {

45 "import": "./dist/enforce.js",

46 "require": "./scripts/lib/cjs-not-supported.cjs",

47 "types": "./dist/enforce.d.ts"

48 },

49 "./environment": {

50 "import": "./dist/environment/index.js",

51 "require": "./scripts/lib/cjs-not-supported.cjs",

52 "types": "./dist/environment/index.d.ts"

53 },

54 "./lib": {

55 "import": "./dist/lib.js",

56 "require": "./scripts/lib/cjs-not-supported.cjs",

57 "types": "./dist/lib.d.ts"

58 }

59 },

60 "type": "module",

61 "scripts": {

62 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

64 "postbuild:ts": "node scripts/ensure-bin-executable.mjs",

65 "bootstrap:dashboard": "node -e \"if (!require('fs').existsSync('dashboard/node_modules')) { process.exit(1); }\" || (cd dashboard && npm ci --no-audit --no-fund)",

67 "build": "npm run build:ts && npm run build:dashboard",

68 "start": "node dist/index.js",

69 "start:api": "node dist/index.js --mode api",

70 "start:dashboard": "node dist/index.js --dashboard",

71 "dev": "tsx src/index.ts",

72 "dev:api": "tsx src/index.ts --mode api",

73 "dev:dashboard": "tsx src/index.ts --dashboard",

74 "watch": "tsc --watch",

75 "test": "node scripts/run-jest.mjs",

76 "test:watch": "node scripts/run-jest.mjs --watch",

77 "test:coverage": "node scripts/run-jest.mjs --coverage",

78 "test:dist": "node scripts/check-no-bare-require.mjs",

79 "guard:precision": "node scripts/run-guard-precision.mjs",

80 "bench": "tsx benchmark/longmemeval/run.ts",

81 "bench:smoke": "SHIELDCORTEX_SKIP_EMBEDDINGS=1 tsx benchmark/longmemeval/run.ts --quiet",

82 "audit:security": "npm audit --audit-level=moderate",

dist/database/init.jsView file

Lines 1-29javascript

1/**

2 * Database initialization and connection management

3 */

4import { getBetterSqlite3 } from './better-sqlite3-guard.js';

5import { NativeModuleLoadError, isNativeModuleLoadError, formatNativeLoadError } from './native-load-classify.js';

6import { existsSync, readFileSync, statSync, writeFileSync, unlinkSync, renameSync, copyFileSync, readdirSync, openSync, closeSync, realpathSync } from

dist/setup/hooks.jsView file

Lines 33-73javascript

33 const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

34 if (!config.customHooks || typeof config.customHooks !== 'object'

dist/database/better-sqlite3-guard.jsView file

Lines 1-37javascript

1/**

2 * Guarded loader for the better-sqlite3 native module.

3 *

4 * better-sqlite3 13 ships Node-API prebuilt binaries per PLATFORM (not per

5 * Node ABI), so a Node upgrade no longer strands the binding — that was the

6 * 12.x failure mode, where a Node version newer than the installed prebuilds

7 * (and with no C++ toolchain to compile from source) failed to load with a

8 * bare `libc++abi: terminating ... Napi::Error` crash-loop and zero guidance.

9 * An unsupported platform, a stripped install or a half-finished local build

hooks/openclaw/cortex-memory/handler.tsView file

Lines 34-74typescript

34// case auto-capture is simply skipped (we do NOT regrow the old high-salience

35// bespoke-extractor path). The wrapper imports nothing native; persistence

36// still flows only through callCortex's mcporter shell-out.

37const loadOpenClawExtract = runtime.loadOpenClawExtract;

38// Resolves the ShieldCortex package root from the resolved server binary (no

39// DB access). Used by selfCheckAndHeal to compare the running hook against the

40// packaged source for staleness — warn-only, never re-copies from the gateway.

dist/setup/deep-clean.jsView file

Lines 1-41javascript

1/**

2 * Deep-clean / residue detection for ShieldCortex ↔ OpenClaw integration.

3 *

4 * The standard `uninstall` and `uninstallPlugin` code paths only fire when

5 * the on-disk artefacts they expected are still present. Partial uninstalls,

6 * manual cleanups, and version-to-version shape changes left orphaned config

7 * entries in `~/.openclaw/openclaw.json` and `~/.openclaw/workspace/.clawhub/lock.json`

8 * that kept producing "plugin references without files" and "missing skill file"

9 * warnings until purged by hand (see incident notes 2026-04-23/24).

10 *

dist/index.jsView file

Lines 330-370javascript

330 return null;

331}

332/**

333 * Start the Next.js dashboard as a supervised child process.

334 *

335 * v4.27.1: if the child exits while the parent is still alive (crash, OOM,

336 * port conflict at startup, etc.), respawn it with exponential backoff

337 * (1 → 2 → 4 → 8 → 16 → 32 → 60 s, capped). Without this, a single child

338 * crash leaves the parent serving only the API on :3001 while :3030 stays

dashboard/.next/standalone/dashboard/node_modules/next/dist/compiled/edge-runtime/index.jsView file

1(()=>{var __webpack_modules__={687:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dashboard/.next/standalone/dashboard/node_modules/next/dist/compiled/edge-runtime/index.jsView on unpkg · L1

dashboard/.next/standalone/dashboard/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1View file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dashboard/.next/standalone/dashboard/node_modules/next/dist/lib/typescript/runTypeScriptCli.js#virtual:normalized:round1View on unpkg · L36

dist/setup/uninstall.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/uninstall.jsView on unpkg

dist/setup/openclaw.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/setup/openclaw.jsView on unpkg

dist/service/install.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service/install.jsView on unpkg · L12

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service/install.jsView on unpkg

plugins/hermes/shieldcortex/sc_client.pyView file

•path = plugins/hermes/shieldcortex/sc_client.py kind = build_helper sizeBytes = 14429 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/hermes/shieldcortex/sc_client.pyView on unpkg

dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.bodyView file

•path = dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.body kind = high_entropy_blob sizeBytes = 26212 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dashboard/.next/standalone/dashboard/.next/server/app/apple-icon.png.bodyView on unpkg

plugins/hermes/shieldcortex/tests/test_shadow_parity.pyView file

•path = [redacted]test_shadow_parity.py kind = payload_in_excluded_dir sizeBytes = 19416 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/hermes/shieldcortex/tests/test_shadow_parity.pyView on unpkg

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 55

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/defence/skill-scanner/scan-skill.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/defence/skill-scanner/scan-skill.jsView on unpkg

dist/integrations/openclaw-gateway-roster.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/openclaw-gateway-roster.jsView on unpkg

dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dashboard/.next/standalone/dashboard/node_modules/@next/env/dist/index.jsView on unpkg

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dashboard/.next/standalone/dashboard/node_modules/next/dist/build/next-config-ts/transpile-config.jsView on unpkg

dist/api/routes/xray.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api/routes/xray.jsView on unpkg

dist/audit/dependency-scanner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/dependency-scanner.jsView on unpkg

dist/audit/env-scanner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/env-scanner.jsView on unpkg

dist/integrations/claude-code-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/claude-code-version.jsView on unpkg

shieldcortex@5.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code