High SeverityInfrastructure

Supply Chain Attacks

When your dependencies are compromised

AI agents depend on many packages, models, and services. A compromise in any of these can give attackers access to your deployment.

What is Supply Chain?

Supply chain attacks target the dependencies your AI agent relies on rather than your code directly. Modern AI deployments use many components:

- Python/Node packages from PyPI/npm - Pre-trained AI models - Docker base images - LLM provider APIs - Plugins and extensions - Shared libraries

Each of these is a potential attack vector. If an attacker compromises any dependency, they can inject malicious code that runs in your environment with your agent's privileges. These attacks are particularly dangerous because: - You trust dependencies implicitly - Updates often happen automatically - Malicious code can be hidden and obfuscated - The attack surface is huge

How Supply Chain Works

Dependency Confusion

Attackers publish packages with names similar to internal packages, hoping you'll install the wrong one.

Typosquatting

Packages with names that are slight misspellings of popular packages.

Maintainer Compromise

Attackers gain access to legitimate package maintainer accounts.

Malicious Updates

A previously safe package pushes a compromised update.

Model Poisoning

Pre-trained models contain hidden behaviors or backdoors.

Container Image Tampering

Base Docker images modified to include malware.

Real-World Example

The event-stream incident affected millions of developers:

1. An attacker offered to help maintain a popular npm package 2. The original maintainer, who was burned out, transferred ownership 3. The attacker added a malicious dependency in a minor update 4. The code targeted a specific cryptocurrency wallet application 5. Millions of projects were potentially affected

Similar attacks have targeted Python packages, with malicious code that exfiltrates environment variables (including API keys) during package installation.

Potential Impact

Complete compromise through trusted code
Credential theft from installation scripts
Backdoors in your production environment
Data exfiltration through legitimate-looking updates
Cryptocurrency mining in your infrastructure
Extremely difficult to detect and trace

Self-Hosted Vulnerabilities

When you self-host your OpenClaw, you're responsible for addressing these risks:

No vetting of package installations
pip install and npm install trusted implicitly
Pre-trained models downloaded without verification
Docker images pulled from public registries
Automatic updates can introduce compromises
No monitoring of dependency behavior

How Clawctl Protects You

Clawctl includes built-in protection against supply chain:

Curated Dependencies

Pre-vetted packages and models. Only approved dependencies are available in the execution environment.

Version Pinning

Dependencies are pinned to known-good versions. No automatic updates that could introduce compromises.

Sandboxed Installation

Package installation happens in isolated environments. Malicious install scripts can't affect your deployment.

Egress Controls

Even if a dependency is compromised, egress controls prevent data exfiltration.

Behavior Monitoring

Unusual behavior from dependencies (unexpected network calls, file access) triggers alerts.

General Prevention Tips

Whether you use Clawctl or not, follow these best practices:

Pin all dependency versions explicitly
Use lock files and verify checksums
Audit dependencies before adding them
Monitor for security advisories on your dependencies
Use private package registries with vetting
Scan dependencies for known vulnerabilities

Don't risk supply chain

Clawctl includes enterprise-grade protection against this threat and many others. Deploy your OpenClaw securely in 60 seconds.