zaloclaw@2.5.6: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

zaloclaw@2.5.6: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

dist/index.jsView file

Lines 4664-4710javascript

4664 "\u{1F606}": Reactions2.HAHA,

4665 "\u{1F62E}": Reactions2.WOW,

4666 "\u{1F622}": Reactions2.CRY,

4667 "\u{1F620}": Reactions2.ANGRY

4668};

4669function resolveReaction(raw) {

4670 return REACTION_MAP[raw.toLowerCase()] ?? raw;

4671}

4672async function handleChannelEnable(enable) {

4673 try {

4674 const cfg = safeReadConfig();

4675 const updated = updateZaloClawConfig(cfg, { enabled: enable });

4676 safeWriteConfig(updated);

4677 setTimeout(() => process.kill(process.pid, "SIGUSR1"), 300);

4678 return ok({ success: true, enabled: enable, message: `ZaloClaw channel ${enable ? "enabled" : "disabled"}. Gateway hot-reloading...` });

4679 } catch (err) {

4680 return ok({ error: true, message: `Failed to ${enable ? "enable" : "disable"} channel: ${String(err)}` });

4681 }

4682}

4683async function handleSelfUpdate() {

4684 try {

4685 const { execSync } = await import("node:child_process");

4686 const pluginDir = nodePath.resolve(nodePath.dirname(new URL(import.meta.url).pathname), "..");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4684

4687 const pull = execSync("git pull origin main 2>&1", { cwd: pluginDir, encoding: "utf-8", timeout: 3e4 });

4688 if (pull.includes("Already up to date")) {

4689 return ok({ updated: false, message: "ZaloClaw is already up to date." });

4690 }

4691 execSync("npm install --prefer-offline 2>&1", { cwd: pluginDir, encoding: "utf-8", timeout: 12e4 });

4692 execSync("npm run build 2>&1", { cwd: pluginDir, encoding: "utf-8", timeout: 3e4 });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4690

4693 setTimeout(() => process.kill(process.pid, "SIGUSR1"), 500);

4694 return ok({ updated: true, message: "ZaloClaw updated. Gateway hot-reloading...", output: pull.trim() });

4695 } catch (err) {

4696 return ok({ error: true, message: `Self-update failed: ${String(err)}` });

4697 }

4698}

4699async function executeZaloClawTool(_callId, p, _signal) {

4700 try {

4701 return await dispatch(p);

4702 } catch (err) {

4703 const msg = err instanceof Error ? err.message : String(err);

4704 return ok({ error: true, message: msg });

4705 }

4706}

4707async function dispatch(p) {

4708 const api = async () => getApi();

4709 switch (p.action) {

4710 // ── Messaging ──────────────────────────────────────────────────────────

•matchType = previous_version_dangerous_delta matchedPackage = zaloclaw@2.5.5 matchedIdentity = npm:emFsb2NsYXc:2.5.5 similarity = 0.944 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg