registry / AI-agent control-surface risk / spareai

spareai

Sell your spare AI capacity — the SpareAI provider CLI turns idle Claude / Codex / Gemini subscription quota into per-request income.

This report shows the evidence for spareai@0.21.0. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a concrete postinstall chain that downloads remotely controlled content into multiple unrelated agent configuration surfaces. This meets the blocking policy independent of scanner labels.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install, including transitive installation when lifecycle scripts are enabled

Impact

Unreviewed remote instructions gain availability as Claude, OpenClaw, and Codex skills; install mutates the user environment.

Mechanism

postinstall remote agent-skill injection and external package-manager execution

Policy narrative

Installing the package automatically executes install-skill.cjs. It fetches markdown from clawmoney.ai and writes it as active skills/commands under Claude, OpenClaw, and Codex user configuration directories, without user setup action or content pinning. The same postinstall then invokes system package managers to install yt-dlp. This is an unconsented install-time mutation of broad foreign AI-agent control surfaces.

AI rationale

Evidence

package.jsonscripts/install-skill.cjsscripts/install-ytdlp.cjs~/.claude/commands/clawmoney.md~/.openclaw/skills/clawmoney/SKILL.md~/.codex/skills/clawmoney/SKILL.md

Network endpoints1

clawmoney.ai/skill.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs two scripts automatically in postinstall.
install-skill downloads remote content and writes it into Claude, OpenClaw, and Codex agent directories.
The remote skill is only checked for YAML front matter; its instructions are not package-pinned or reviewed.
install-ytdlp invokes brew, pip, apt, or winget during installation.

Evidence against

No credential collection or exfiltration occurs in the postinstall skill writer itself.
The package CLI's normal network activity is user-invoked, but does not mitigate the install-time writes.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 263 file(s), 1.16 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.bnbot.ai, api.github.com, api.iconify.design, api.kimi.com, api.minimax.io, api.minimaxi.com, api.z.ai, auth.kimi.com, auth.openai.com, chatgpt.com, chromewebstore.google.com, clawmoney.ai, cloudcode-pa.googleapis.com, coding.dashscope.aliyuncs.com, creator.douyin.com, creator.xiaohongshu.com, daily-cloudcode-pa.sandbox.googleapis.com, gemini.google.com, generativelanguage.googleapis.com, github.com, keepachangelog.com, labs.google, m.tiktok.com, mainnet.base.org, myaccount.google.com, oauth2.googleapis.com, pay.clawmoney.ai, platform.claude.com, semver.org, twitter.com, witness.bnbot.ai, www.bilibili.com, www.googleapis.com, www.tiktok.com, www.w3.org, www.youtube.com, x.com

Source & flagged code

17 flagged

package.jsonView file

Lines 1-40json

2 "name": "spareai",

3 "version": "0.21.0",

4 "description": "Sell your spare AI capacity — the SpareAI provider CLI turns idle Claude / Codex / Gemini subscription quota into per-request income.",

5 "type": "module",

6 "bin": {

7 "spareai": "dist/index.js",

8 "clawmoney": "dist/index.js"

9 },

10 "main": "dist/index.js",

11 "files": [

12 "dist",

13 "scripts",

14 "companion"

15 ],

16 "scripts": {

17 "build": "tsc",

18 "dev": "tsc --watch",

19 "test:grok": "node scripts/test-grok-api.mjs",

20 "postinstall": "node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "prepublishOnly": "npm run build"

22 },

23 "dependencies": {

24 "@bnbot/cli": "^0.3.0",

25 "@clack/prompts": "^0.7.0",

26 "chalk": "^5.3.0",

27 "commander": "^12.0.0",

28 "ora": "^8.0.0",

29 "undici": "^6.21.3",

30 "viem": "^2.48.1",

31 "ws": "^8.20.0",

32 "yaml": "^2.4.0"

33 },

34 "devDependencies": {

35 "@types/node": "^20.0.0",

36 "@types/ws": "^8.18.1",

37 "typescript": "^5.4.0"

38 },

39 "engines": {

40 "node": ">=18"

dist/ui/companion.jsView file

Lines 1-29javascript

1// Companion launcher: ensure the Electron companion is installed + running,

2// then talk to it. This is the "reverse-launch" awal does — the CLI brings up

3// the GUI on demand, zero app install for the user.

4//

5// Why a per-user run dir (~/.spareai/companion) instead of running straight

6// from the installed package: the global npm package dir is often not writable,

7// and we need to `npm i electron` somewhere. So we copy the tiny companion

8// files into the user's home and install Electron there (awal uses env-paths

9// for the same reason).

10import

dist/commands/tweet.jsView file

Lines 1-30javascript

1import chalk from 'chalk';

2import { spawn } from 'node:child_process';

3/**

4 * Post a tweet by delegating to @bnbot/cli.

5 */

6export async function

dist/relay/upstream/claude-bootstrap.jsView file

Lines 264-304javascript

264 cleanup();

265 reject(new Error(`bootstrap proxy server error: ${err.message}`));

266 });

267 server.listen(0, "127.0.0.1"

scripts/probe-claude-api.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Validate that a locally-logged-in Claude Code OAuth token can be used to

3// call api.anthropic.com directly with the exact headers + body shape Claude

4// Code sends (captured from claude-cli/2.1.100 via ANTHROPIC_LOG=debug).

5//

6// Usage:

7// node scripts/probe-claude-api.mjs # send test request

8// node scripts/probe-claude-api.mjs --refresh # force refresh first

9// node scripts/probe-claude-api.mjs --prompt "hello"

10// node scripts/probe-claude-api.mjs --model claude-sonnet-4-5

dist/relay/upstream/claude-api.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/relay/upstream/claude-api.js: * Token is loaded once at startup (from macOS Keychain or ~/.claude) and import { readFileSync, writeFileSync, existsSync } from "node:fs"; const OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token"; const CLAUDE_CREDENTIALS_FILE_PATH = join(homedir(), ".claude", ".credentials.json"); const oauth = raw.claudeAiOauth; throw new Error("Claude Code credentials not found (checked keychain, ~/.claude/.credentials.json, " + wrapper.claudeAiOauth = { ...wrapper.claudeAiOauth,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/relay/upstream/claude-api.jsView on unpkg

scripts/install-skill.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Post-install: automatically install ClawMoney skill to all agent platforms.

5 * Runs after `npm i -g clawmoney`.

6 */

8const { mkdirSync, writeFileSync } = require('fs');

dist/utils/awal.jsView file

14return new Promise((resolve, reject) => { L15: const child = spawn('npx', ['awal', ...finalArgs], { L16: stdio: ['inherit', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/awal.jsView on unpkg · L14

scripts/install-market-launchd.shView file

•path = scripts/install-market-launchd.sh kind = build_helper sizeBytes = 6898 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-market-launchd.shView on unpkg

dist/task/skills/youtube/_ytdlp.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/task/skills/youtube/_ytdlp.jsView on unpkg

companion/main.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = companion/main.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

companion/main.jsView on unpkg

dist/relay/upstream/codex-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = dist/relay/upstream/codex-bootstrap.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relay/upstream/codex-bootstrap.jsView on unpkg

dist/relay/upstream/gemini-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = dist/relay/upstream/gemini-bootstrap.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relay/upstream/gemini-bootstrap.jsView on unpkg

dist/task/preflight.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = dist/task/preflight.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/task/preflight.jsView on unpkg

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/companion.jsView file

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/companion.jsView on unpkg · L9

Findings

2 Critical13 High5 Medium5 Low

CriticalCredential Exfiltrationscripts/probe-claude-api.mjs

CriticalAi Agent Control Hijackscripts/install-skill.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/ui/companion.js

HighShelldist/commands/tweet.js

HighSame File Env Network Executiondist/relay/upstream/claude-bootstrap.js

HighCredential Redirect Persistencedist/relay/upstream/claude-api.js

HighSandbox Evasion Gated Capabilitydist/ui/companion.js

HighRuntime Package Installdist/utils/awal.js

HighSemantic Analysis Limiteddist/task/skills/youtube/_ytdlp.js

HighKnown Malware Source Similaritycompanion/main.js

Affected versions and remediation

This report applies to spareai@0.21.0.

The versions list below shows the verdict for each recorded version.

Avoid installing spareai@0.21.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-15 09:45:59.170Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.21.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 15, 2026, 8:56 AM 0.20.3MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 13, 2026, 10:27 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages