claw-subagent-service

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b2ccba152d6841731431c91157874c72b5f9778fdf88b634a45ab5d9da961307)
On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service` pointing at `service/daemon.js`, configured with `sc.exe failure... actions= restart/0/restart/0/restart/0` and `start= auto`, then immediately starts it — running as LocalSystem on Windows with no opt-in prompt. Once running, three behaviors stack into a remote-control surface against the installer:

1. Self-replacing update channel (`service/updater.js`): a 6-hour interval calls `npm view claw-subagent-service version --json` and, when a newer version is published, runs `npm install -g claw-subagent-service@<latest>` and restarts the worker. Any future tarball published under this name is fetched and executed under LocalSystem (Windows) / user (macOS) without consent and without honoring the operator's pinning. Linux is gated, Windows + macOS are not.

2. Vendor-controlled IM command channel (`service/worker.js`, `service/modules/rongyun-message-handler.js`, `service/modules/script-executor.js`, `service/rongcloud/openclaw-client.js`): the worker fetches a token from `https://newsradar.dreamdt.cn/im/api/claw/token/<nodeId>` and joins a RongCloud IM session (appKey `bmdehs6pbyyks`). `RongyunMessageHandler` dispatches inbound `COMMAND` / `DEVICE_CONTROL` / `CHAT_MESSAGE` messages to handlers that `spawn` `start.sh`/`stop.sh`/`restart.sh`/`status.sh`, run `openclaw doctor --fix`, and feed attacker-supplied prompts into the local AI agent (which can in turn invoke arbitrary tools). Whoever controls the vendor IM backend (or its appKey) has persistent privileged shell-class access to every installer machine.

3. Continuous data exfiltration (`service/modules/heartbeat-dashboard.js`, `service/modules/dashboard-collector.js`): every 30 seconds the worker reads `~/.openclaw/agents/*/sessions/*.jsonl`, `~/.openclaw/projects/projects.json`, `~/.openclaw/tasks/tasks.json`, and the host MAC address, and ships them as 6 RongCloud IM messages to the vendor backend. Includes session contents, model-provider metadata, token-usage events, and a stable host identifier.

The README documents the product's purpose, but the combination — postinstall privileged-service persistence + 6-hour silent self-replacement + always-on remote-command IM channel + continuous session/host-id upload — is a vendor-operated remote-administration agent installed on the operator's machine via `npm install`. A compromise of the publisher account or the vendor IM backend yields immediate, unattended code execution on every installer host.

Compromised versions (34)

• 0.0.80
• 0.0.91
• 0.0.120
• 0.0.113
• 0.0.99
• 0.0.101
• 0.0.116
• 0.0.122
• 0.0.105
• 0.0.138
• 0.0.108
• 0.0.102
• 0.0.109
• 0.0.140
• 0.0.136
• 0.0.130
• 0.0.117
• 0.0.110
• 0.0.141
• 0.0.137
• 0.0.114
• 0.0.151
• 0.0.149
• 0.0.146
• 0.0.162
• 0.0.170
• 0.0.177
• 0.0.156
• 0.0.161
• 0.0.168
• 0.0.164
• 0.0.160
• 0.0.153
• 0.0.179

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.