37/100 (High)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： suspicious

OpenClaw： suspicious

The package matches its stated purpose as an AI 'OS' installer, but it makes broad, high‑impact system changes (global git hooks, cron process monitor), reads and backs up other apps' data (OpenClaw, ...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： suspicious

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

README 未提供

{
    "latestVersion": {
        "_creationTime": 1774812966417,
        "_id": "k97drd99z2q9h21y3pmwqg48ks83tap1",
        "changelog": "# Release Notes: wip-ldm-os v0.4.61\n\n**Fix installer: stop recursive subprocess spawning, fix tavily catalog resolution.**\n\n## The story\n\nTwo installer bugs causing a 3.5 minute install time that should take seconds:\n\n1. When installing catalog components, the installer spawned `execSync('ldm install ')` for each one. Each subprocess ran the full installer: system state check, catalog lookup, npm check, clone, detect, deploy. For 12 toolbox sub-tools, that's 12 full installer runs. Replaced with a direct `installCatalogComponent()` function call that clones (with --depth 1) and installs in one pass.\n\n2. `findInCatalog('wipcomputer\/openclaw-tavily')` matched the `openclaw` catalog entry because `\"wipcomputer\/openclaw-tavily\".includes(\"openclaw\")` was true. The installer then cloned the entire OpenClaw platform repo (instead of the tiny tavily plugin). Fixed the partial match to require hyphen-aligned word boundaries. Added exact repo URL matching.\n\n## Issues closed\n\n- #232 (installer performance + tavily resolution)\n\n## How to verify\n\n```bash\ntime ldm install\n# Should complete in seconds, not minutes\n# Tavily should NOT clone openclaw\/openclaw\n```",
        "changelogSource": "user",
        "createdAt": 1774812966417,
        "parsed": {
            "clawdis": {
                "emoji": "🧠",
                "install": [
                    {
                        "bins": [
                            "ldm"
                        ],
                        "id": "node",
                        "kind": "node",
                        "label": "Install LDM OS via npm",
                        "package": "@wipcomputer\/wip-ldm-os"
                    }
                ],
                "requires": {
                    "bins": [
                        "git",
                        "npm",
                        "node"
                    ]
                }
            }
        },
        "version": "0.4.61"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "s17620xzyc7kfan8m36at57m6n83h8he",
        "displayName": "Parker Todd Brooks",
        "handle": "parkertoddbrooks",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/585456?v=4",
        "kind": "user",
        "linkedUserId": "kn7b4mj57xb02gqhvjzgzkxq557zz95h"
    },
    "ownerHandle": "parkertoddbrooks",
    "skill": {
        "_creationTime": 1773380753571,
        "_id": "kd71xbydfjyb22a5x577r2whvx82ts90",
        "badges": [],
        "createdAt": 1773380753571,
        "displayName": "Wip Ldm Os Private",
        "latestVersionId": "k97drd99z2q9h21y3pmwqg48ks83tap1",
        "ownerPublisherId": "s17620xzyc7kfan8m36at57m6n83h8he",
        "ownerUserId": "kn7b4mj57xb02gqhvjzgzkxq557zz95h",
        "slug": "wip-ldm-os",
        "stats": {
            "comments": 0,
            "downloads": 519,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 80
        },
        "summary": "LDM OS installer and updater. Use when asked to install, update, or check status of LDM OS. Use when user pastes an install prompt mentioning wip.computer\/in...",
        "tags": {
            "latest": "k97drd99z2q9h21y3pmwqg48ks83tap1"
        },
        "updatedAt": 1774816606896
    }
}