Detonation LabsBehavioral security for the AI agent supply chain

Verdict

No malicious behavior observed

We ran it 8 times, with a normal setup, ANDROID_DATA and APPENGINE_RUNTIME and CURL_CA_BUNDLE and DEB_PYTHON_INSTALL_LAYOUT… set, PIP_INDEX_URL set, a GitHub Actions environment and ANDROID_DATA and APPENGINE_RUNTIME and CI and CURL_CA_BUNDLE… set. It contacted cdn.npmmirror.com, ghfast.top and goproxy.cn and others. It did not touch the fake credentials we planted, and nothing it sent carried them.

2 findings. Scanned 27 Oct 2026 by detonator 0.5.1.

Target
cn-mirror-download
Source
clawhub 1.0.0
SHA-256
f654562c5c07a45f
Files
5
RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-27

What this package does

observed across 8 runs
  1. Package cn-mirror-download 5 files · agent skill
  2. Install No install stepFiles were copied in as they are.
  3. Runs as curl -sS -o /dev/null -m 8curl -fL -C - --retry 5git clone --depth 1 https://ghfast.top/https://github.com/OWNER/REPO.git/usr/lib/git-core/git remote-https origin https://ghfast.top/https://github.com/OWNER/REPO
  4. What it reached
    Network
    • cdn.npmmirror.com 8 connections, 540 B sent
    • ghfast.top 19 connections, 2.3 KB sent
    • goproxy.cn 8 connections, 400 B sent
    • hf-mirror.com 8 connections, 412 B sent
    • maven.aliyun.com 8 connections, 584 B sent
    • mirror.sjtu.edu.cn 8 connections, 416 B sent
    • mirrors.aliyun.com 8 connections, 400 B sent
    • mirrors.cloud.tencent.com 8 connections, 428 B sent
    • mirrors.huaweicloud.com 8 connections, 464 B sent
    • mirrors.ustc.edu.cn 8 connections, 404 B sent
    • pypi.tuna.tsinghua.edu.cn 8 connections, 408 B sent
    • registry.npmjs.org 5 connections
    • registry.npmmirror.com 8 connections, 352 B sent
    • rsproxy.cn 8 connections, 352 B sent
    Credentials

    None of the planted fake keys were touched.

    ~/.npmrc read by its own tool (normal)

    Files written
    • ./FILEwritten
    • ./REPO/.git/HEAD.lockwritten
    • ./REPO/.git/config.lockwritten
    • ./REPO/.git/descriptionwritten
    • ./REPO/.git/info/excludewritten
    • ./REPO/.git/t1oh5t0written
    • ./REPO/.git/t6kWVoHwritten
    • ./REPO/.git/t813V5gwritten
    • ./REPO/.git/tC0MaAqwritten
    • ./REPO/.git/tJg1596written
    • ./REPO/.git/tXSOFyzwritten
    • ./REPO/.git/tb7jftuwritten

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Network destinations contacted

Confidence
Info The package connected to these hosts.
Observed in
obedient:baseline, obedient:ci-github

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

cdn.npmmirror.com
ghfast.top
goproxy.cn
hf-mirror.com
maven.aliyun.com
mirror.sjtu.edu.cn
mirrors.aliyun.com
mirrors.cloud.tencent.com

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

F02 Low

A tool read its own credentials (e.g. gh, aws, ssh)

Confidence
Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
Observed in
obedient:baseline

Description

A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.

Impact

None in itself: this is how those tools work. Listed so the report shows every credential access.

Evidence

~/.npmrc (by npm)

Remediation

No action needed.

Process tree

run obedient:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree
  • runbash -c probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -s...
    • runcurl -sS -o /dev/null -m 8
      • netpypi.tuna.tsinghua.edu.cn:443 sent 102 B
    • runcurl -sS -o /dev/null -m 8
      • netmirrors.aliyun.com:443 sent 100 B
    • runcurl -sS -o /dev/null -m 8
      • netmirrors.cloud.tencent.com:443 sent 107 B
    • runcurl -sS -o /dev/null -m 8
      • netmirrors.huaweicloud.com:443 sent 116 B
    • runcurl -sS -o /dev/null -m 8
      • netmirrors.ustc.edu.cn:443 sent 101 B
    • runcurl -sS -o /dev/null -m 8
      • netmirror.sjtu.edu.cn:443 sent 104 B
    • runcurl -sS -o /dev/null -m 8
      • netregistry.npmmirror.com:443 sent 88 B
    • runcurl -sS -o /dev/null -m 8
      • netgoproxy.cn:443 sent 100 B
    • runcurl -sS -o /dev/null -m 8
      • netrsproxy.cn:443 sent 88 B
    • runcurl -sS -o /dev/null -m 8
      • netmaven.aliyun.com:443 sent 146 B
    • runcurl -sS -o /dev/null -m 8
      • netcdn.npmmirror.com:443 sent 135 B
    • runcurl -sS -o /dev/null -m 8
      • netghfast.top:443 sent 138 B
  • runbash -c export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/si...
  • runbash -c fetch_gh() { local url="$1" out="${2:-$(basename "$url"...
    • runcurl -fL -C - --retry 5
      • nethf-mirror.com:443 sent 103 B
      • filewrote ./FILE
    • rungit clone --depth 1 https://ghfast.top/https://github.com/OWNER/REPO.git
      • filewrote ./REPO/.git/description
      • filewrote ./REPO/.git/info/exclude
      • filewrote ./REPO/.git/HEAD.lock
      • filewrote ./REPO/.git/config.lock
      • filewrote ./REPO/.git/t1oh5t0
      • run/usr/lib/git-core/git remote-https origin https://ghfast.top/https://github.com/OWNER/REPO.git
        • run/usr/lib/git-core/git-remote-https origin https://ghfast.top/https://github.com/OWNER/REPO.git
          • netghfast.top:443 sent 254 B
          • netghfast.top:443 sent 200 B
  • runbash -c pip config list | grep -i index # 或 pip -v i...
    • runpip config list
    • rungrep -i index
    • runnpm config get registry
      • runnode /usr/bin/npm config get registry
        • secretread ~/.npmrc (its own config)
        • netregistry.npmjs.org:443
        • netDNS lookups for aliyun.com, edu.cn, ghfast.top, goproxy.cn, hf-mirror.com, huaweicloud.com, npmjs.org, npmmirror.com, rsproxy.cn, tencent.com 30 queries
    • rungrep -i config
    • runcat ~/.cargo/config.toml
    • rungrep -A3 Registry Mirrors

Exploration log

8 runs
  1. obedient:baseline ok · 19.9s

    new behavior: dns:cdn.npmmirror.com, dns:ghfast.top, dns:goproxy.cn, dns:hf-mirror.com

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf
  2. obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,CURL_CA_BUNDLE,DEB_PYTHON_INSTALL_LAYOUT… ok · 21.1s

    new behavior: write:./REPO/.git/t6kWVoH

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf
  3. obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,CURL_CA_BUNDLE,DEB_PYTHON_INSTALL_LAYOUT… ok · 23.5s

    new behavior: write:./REPO/.git/tXSOFyz

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf
  4. obedient:guided:PIP_INDEX_URL ok · 26.1s

    new behavior: write:./REPO/.git/tgkkyVv

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf
  5. obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,CURL_CA_BUNDLE,DEB_PYTHON_INSTALL_LAYOUT… ok · 24.8s

    new behavior: write:./REPO/.git/tb7jftu

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf
  6. obedient:ci-github ok · 21.8s

    new behavior: write:./REPO/.git/t813V5g

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf
  7. obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,CI,CURL_CA_BUNDLE… ok · 20.1s

    new behavior: write:./REPO/.git/tJg1596

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf
  8. obedient:production ok · 33.4s

    new behavior: write:./REPO/.git/tC0MaAq

    $ probe() { for u in "$@"; do printf '%-58s ' "$u"; curl -sS -o /dev/null -m 8 -A "pip/24.0" -w '%{http_code} %{time_total}s\n' "$u" 2>/dev/null || echo "FAIL"; done; } probe https://pypi.tuna.tsinghua. $ export PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple export PIP_EXTRA_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple,https://mirrors.huaweicloud.com/repository/pypi/simple export PIP $ fetch_gh() { local url="$1" out="${2:-$(basename "$url")}" for p in https://ghfast.top/ https://gh-proxy.com/ https://ghproxy.net/ ""; do echo ">> ${p:-direct}$url" curl -fL --retry 3 --co $ pip config list | grep -i index # 或 pip -v install X 看 "Looking in indexes" npm config get registry go env GOPROXY GOSUMDB cargo -Vv | grep -i "config" ; cat ~/.cargo/config.toml docker inf

obedient: run budget spent; llm: run budget spent

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.