registry / theclawbay / 0.6.1

theclawbay@0.6.1

CLI for connecting Codex, Hermes Agent, Gemini-compatible apps, Continue, Cline, GSD, OpenClaw, OpenCode, Kilo, Roo Code, Aider, experimental Trae, and experimental Zo to The Claw Bay.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 459 KB of source, external domains: 127.0.0.1, aider.chat, api.openai.com, api.zo.computer, cline.bot, code.claude.com, continue.dev, github.com, hermes-agent.nousresearch.com, kilo.ai, openai.com, openclaw.ai, opencode.ai, registry.npmjs.org, roocode.com, theclawbay.com, www.trae.ai, www.zo.computer

Source & flagged code

4 flagged

dist/lib/clients/zo.jsView file

Lines 1-39javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.ZO_API_BASE_URL = exports.ZO_ACCESS_TOKEN_COOKIE = exports.ZO_COOKIE_HOST = exports.ZO_CONFIG_NAME_PREFIX = exports.DEFAULT_ZO_MODEL = void 0;

7exports.zoCookieDbCandidates = zoCookieDbCandidates;

8exports.zoProgramCandidates = zoProgramCandidates;

9exports.pythonCommandCandidates = pythonCommandCandidates;

10exports.readZoCookieValue = readZoCookieValue;

11exports.parseZoByokConfig = parseZoByokConfig;

12exports.zoApiRequest = zoApiRequest;

13exports.configureZoByok = configureZoByok;

14exports.detectZoClient = detectZoClient;

15const models_1 = require("../shared/models");

16const node_os_1 = __importDefault(require("node:os"));

17const node_path_1 = __importDefault(require("node:path"));

18const platform_1 = require("../shared/platform");

19const node_fs_1 = require("node:fs");

20const node_child_process_1 = require("node:child_process");

21const backend_1 = require("../shared/backend");

High

Child Process

Package source references child process execution.

dist/lib/clients/zo.jsView on unpkg · L19

22const urls_1 = require("../shared/urls");

23const fsx_1 = require("../shared/fsx");

24// Extracted from src/commands/setup.ts (theclawbay CLI restructure).

25// Code motion only: bodies are verbatim from the original file.

26exports.DEFAULT_ZO_MODEL = models_1.DEFAULT_CODEX_MODEL;

27exports.ZO_CONFIG_NAME_PREFIX = "The Claw Bay";

28exports.ZO_COOKIE_HOST = ".zo.computer";

29exports.ZO_ACCESS_TOKEN_COOKIE = "access_token";

30exports.ZO_API_BASE_URL = "https://api.zo.computer";

31function zoCookieDbCandidates() {

32 const home = node_os_1.default.homedir();

33 const candidates = new Set();

34 switch (node_os_1.default.platform()) {

35 case "win32":

36 candidates.add(node_path_1.default.join((0, platform_1.roamingAppDataDir)(), "Zo", "Network", "Cookies"));

37 break;

38 case "darwin":

39 candidates.add(node_path_1.default.join(home, "Library", "Application Support", "Zo", "Network", "Cookies"));

dist/lib/device-session-auth.jsView file

Lines 1-28javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/lib/shared/tui.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = theclawbay@0.4.2 matchedIdentity = npm:dGhlY2xhd2JheQ:0.4.2 similarity = 0.810 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/shared/tui.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/lib/clients/zo.jsView file

19const node_fs_1 = require("node:fs"); L20: const node_child_process_1 = require("node:child_process"); L21: const backend_1 = require("../shared/backend");

High

Child Process

Package source references child process execution.

dist/lib/clients/zo.jsView on unpkg · L19

dist/lib/device-session-auth.jsView file

8const promises_1 = __importDefault(require("node:fs/promises")); L9: const node_http_1 = __importDefault(require("node:http")); L10: const node_os_1 = __importDefault(require("node:os")); L11: const node_path_1 = __importDefault(require("node:path")); L12: const node_child_process_1 = require("node:child_process"); L13: const paths_1 = require("./config/paths"); ... L18: function setupSiteBaseUrl() { L19: const override = process.env.THECLAWBAY_SETUP_SITE_URL?.trim(); L20: if (override)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/device-session-auth.jsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib/device-session-auth.jsView on unpkg · L8

dist/lib/shared/tui.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/shared/tui.jsView on unpkg

Findings

4 High3 Medium5 Low

HighChild Processdist/lib/clients/zo.js

HighSame File Env Network Executiondist/lib/device-session-auth.js

HighSandbox Evasion Gated Capabilitydist/lib/device-session-auth.js

HighPrevious Version Dangerous Deltadist/lib/shared/tui.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/lib/clients/zo.jsView file

Lines 1-39javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.ZO_API_BASE_URL = exports.ZO_ACCESS_TOKEN_COOKIE = exports.ZO_COOKIE_HOST = exports.ZO_CONFIG_NAME_PREFIX = exports.DEFAULT_ZO_MODEL = void 0;

7exports.zoCookieDbCandidates = zoCookieDbCandidates;

8exports.zoProgramCandidates = zoProgramCandidates;

9exports.pythonCommandCandidates = pythonCommandCandidates;

10exports.readZoCookieValue = readZoCookieValue;

11exports.parseZoByokConfig = parseZoByokConfig;

12exports.zoApiRequest = zoApiRequest;

13exports.configureZoByok = configureZoByok;

14exports.detectZoClient = detectZoClient;

15const models_1 = require("../shared/models");

16const node_os_1 = __importDefault(require("node:os"));

17const node_path_1 = __importDefault(require("node:path"));

18const platform_1 = require("../shared/platform");

19const node_fs_1 = require("node:fs");

20const node_child_process_1 = require("node:child_process");

21const backend_1 = require("../shared/backend");

High

Child Process

Package source references child process execution.

dist/lib/clients/zo.jsView on unpkg · L19

22const urls_1 = require("../shared/urls");

23const fsx_1 = require("../shared/fsx");

24// Extracted from src/commands/setup.ts (theclawbay CLI restructure).

25// Code motion only: bodies are verbatim from the original file.

26exports.DEFAULT_ZO_MODEL = models_1.DEFAULT_CODEX_MODEL;

27exports.ZO_CONFIG_NAME_PREFIX = "The Claw Bay";

28exports.ZO_COOKIE_HOST = ".zo.computer";

29exports.ZO_ACCESS_TOKEN_COOKIE = "access_token";

30exports.ZO_API_BASE_URL = "https://api.zo.computer";

31function zoCookieDbCandidates() {

32 const home = node_os_1.default.homedir();

33 const candidates = new Set();

34 switch (node_os_1.default.platform()) {

35 case "win32":

36 candidates.add(node_path_1.default.join((0, platform_1.roamingAppDataDir)(), "Zo", "Network", "Cookies"));

37 break;

38 case "darwin":

39 candidates.add(node_path_1.default.join(home, "Library", "Application Support", "Zo", "Network", "Cookies"));

dist/lib/device-session-auth.jsView file

Lines 1-28javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

dist/lib/shared/tui.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/shared/tui.jsView on unpkg